Are Firebase Security Rules secure by default?

Firebase test mode allows broad access for a limited period, while production mode starts locked down and requires developers to write rules for their data model. Leaving permissive rules in production can expose data. UNPWNED tests bounded anonymous read and access patterns using public client configuration and flags confirmed public exposure. It does not certify the complete Firebase rule set.