Firebase rules left open in Firebase

Scope each collection to the owner, and block fields the user must not set.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /notes/{noteId} {
      allow read, update, delete: if request.auth != null
        && request.auth.uid == resource.data.userId;
      allow create: if request.auth != null
        && request.auth.uid == request.resource.data.userId;
    }
  }
}

That is a starting shape for one collection, not a full ruleset. Add rules for every collection the app uses. Collections without a match are denied by default when rules are otherwise defined. Do not add a final match /{document=**} { allow read, write: if true; } to be helpful.

Deploy with the Firebase CLI so the repo and the project match. Run the rules emulator tests if you have them. Firebase documents the rules language and the emulator in its security rules docs.

Storage needs its own file. See open storage buckets.