This looks pretty awesome!
I'm falling for the idea of building my next project as a html/javascript app using FireBase (with zero server-side code), but security keeps me wondering, because even after reading everything that the firebase website has to offer about it, I'm still not convinced that it's secure enough.
Am I understanding this right, without explicit rules, anyone can edit all the data in the database? Like anyone can just trash your entire database or fill it with silly amounts of data, using the console, after reading your database credentials in the html file, if you're trying to build an html-only, no-backend app?
I'm curious, how would one build a voting system (a-la hacker news or reddit), what would the permission mask be? Only registered users can vote, but can only increment or decrement the value by x. I'm also confused about how the restriction works, when creating a non-editable title: a registered user is allowed to create a thread and name the title, but is not allowed(not the author or anyone) to edit it after.
If someone could give me a pointer in these use cases, I'd be very grateful.