Do I have to change security rules in firebase if I'm not using database?

Question

If I were to build a site without database interaction (no login on the site) with firebase. Do I need to change default security rules that looks like this:

 {
        "rules": {
            ".read": true,
            ".write": true
        }

 }

This red exclamation sign in the security & rules section says that I better write some security rules. So the question is, is it safe to leave this as is if you don't use login/signup ?

Answer 1

The thing is, FireBase has changed a lot. The new admin area has predefined security measures in place. So, you don't really have to worry about that anymore.

The default set of rules are

{
  "rules": {
    ".read": "auth != null",
    ".write": "auth != null"
  }
}

And in case you want to open them up for both read and write permissions, you can roll back to

{
   "rules": {
     ".read": true,
     ".write": true
   }
}

Answer 2

With the default rule:

 "rules": {
            ".read": true,
            ".write": true
        }

everybody can read and can write your data using the Android,IOS and WEB SDKs.

You should provide a kind of authentication with a Token or with Email/Password authentication.

 "rules": {
         ".read": "auth !== null",
         ".write": "auth !== null",       
       }

Pay attention because your rules don't effect what you can or can't do in the Firebase dashboard. Anyone with access to the dashboard, including collaborators who you share your Firebase dashboard with, can circumvent the rules.

More info here.