How Firestore Security Rules Can Replace a Backend — and Where They Fall Short

A developer building Cuentopia, an AI story app for families, chose a serverless architecture using Firebase and Firestore, with no custom backend server in between. This meant that Firestore security rules became the sole layer protecting user data exposed via a public REST and gRPC API. The author shares lessons learned — including three bugs that each cost a full afternoon — using a fictional bird-sighting app to illustrate real rule patterns. A key testing pitfall highlighted is that assertFails can pass for the wrong reason, masking broken permission logic if test documents are malformed. The author acknowledges remaining gaps, including the cost of in-rule get() calls and the inability of rules to detect stolen user sessions even with App Check enabled.