How do I secure Firestore properly?

Firestore security requires writing granular Security Rules that validate authentication, authorization, and data structure for every collection and document. Rules should check request.auth and enforce ownership and data constraints. Avoid broad wildcard allow rules. UNPWNED tests bounded anonymous read and access patterns and reports confirmed exposure. It does not parse or certify every Firestore rule.