The client sets the price, role, or plan in Firebase

criticalUpdated Oct 12, 2026

Fix for Firebase

allow update: if request.auth.uid == resource.data.userId
  && request.resource.data.role == resource.data.role
  && request.resource.data.plan == resource.data.plan;

Deny changes to privileged fields in rules. The Admin SDK can set them after a verified webhook.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Firebase fixes are on the Firebase page.