TL;DR

When Firestore throws FirebaseError: Missing or insufficient permissions , AI editors often "fix" it by rewriting firestore.rules to allow read, write: if true; or if request.auth != null; .

Your Firebase config ships in every browser bundle by design, so open rules mean anyone can read or overwrite the data, and auth-only rules mean any signed-up user can.

The real fix is usually in the query, not the rules: scope rules to the document owner, then add the matching where() so the query fits the rules.

You ask Cursor or Claude Code to add an orders page to a Firebase app. You load it and the console says FirebaseError: Missing or insufficient permissions . You paste the error back into chat.

The page loads on the next try. The diff is one file, firestore.rules , and it now lets everyone in.

This is the same move AI editors make with Supabase RLS errors and Stripe signature errors.…