Not allowing unauthenticated requests? Look for things like plaintext passwords from one of many giant dictionaries of commonly used passwords and flag that behavior? Look for fields that match credit card numbers? Do better in documentation, especially around any schema creator?

I don’t know enough about the exact security problem (I don’t use firebase) but I’m guessing tossing your hands in the air isn’t the only option.

You know what I mean: open to all authenticated users, authentication being cleared at the app level. Only having to create an account for full access to all data is indeed "open." Would that Facebook used this strategy, the implications would be clear.