How do Firebase Storage Security Rules work?

Firebase Storage Security Rules control who can upload, download, and delete files in Cloud Storage buckets. Rules can check authentication state, file metadata, file size, and content type. Storage rules should scope access to user-specific paths and validate file properties on upload. UNPWNED can report externally observable Firebase exposure signals, but it does not upload files or certify the complete Storage rule set.