title: Firebase Cloud Firestore security rules only allow read not write
body: <p>I made a simple app for underprivileged students so that they can learn during the Pandemic. I update notes for each subject daily through the firebase console (Cloud firestore). No authentication included because the students are small, and not well versed with technology.
  I have only allowed read and deleted the write options in the security rules. Last night I got this email. I have added the image copy. I just want everyone to download the app and read the data(Notes) but no one to write. Is my database safe? Can anyone write, delete or manipulate the database if they got the project id?</p>
  <p>Soon I'm planning to buy the blaze plan but now I'm a little insecure.</p>
  <p>My security rules are as follows:</p>
  <pre><code>rules_version = '2';
  service cloud.firestore {
    match /databases/{database}/documents {
      match /{document=**} {
        allow read;
      }
    }
  }
  </code></pre>
  <p><a href="https://i.stack.imgur.com/xQ6wq.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/xQ6wq.png" alt="enter image description here" /></a> email</p>