Wait, firebase allows full access to http connections accessible from a browser? Wtf? Why would you want to give the user direct access to a database to begin with? Is firebase built around the idea of not running your own servers or something?
All with libraries in a lot of languages to make it easy. Pretty solid product with a cohesive experience and a generous free tier.
Naturally, you'll pay an exorbitant amount once you start to scale and realize you've been locked in.
Crazy giving up that much control of your product to a third party. I can definitely see the appeal to spike realtime/chat projects, though—they really leaned into that api design well. Selling out to google was a mistake.
As a product with a ton of appeal to the least experienced developers, lots of mistakes happen.
My understanding is that (assuming you trust google) there's no reason you can't build a secure application on firebase.