That's what the Database Security Rules [1] are for. If you want to learn more, check out my I/O talk tomorrow called "The key to Firebase security" [2].

[1] http://firebase.google.com/docs/database/security [2] https://events.google.com/io2016/schedule?sid=af641ff7-0bef-...