What are the most common Firebase security mistakes?

The most common mistake is leaving test mode security rules in production. Other frequent issues include broad allow rules, missing write validation, and Cloud Function endpoints without authentication. UNPWNED tests bounded anonymous-access and public-endpoint signals and reports confirmed findings. Data validation and tenant-isolation logic require rule tests and code review.