The rules you have allow anyone who is signed in to your back-end full read access to the entire database. This is only a very basic layer of security. It is also true that this is more secure than just granting everyone access to your database, at least they have to be signed in.

If you enable any auth provider in Firebase Authentication, anyone can sign in to your back-end, even without using your app. And once they are signed in, they can read anything in your database. I would suggest structuring your security rules in a more secure way. You can have a look at the documentation on avoiding insecure rules.

If your rules intentionally allow public reading of all data, you don't store any user data, and you are willing to pay the charges for everyone reading all data, then your rules fit your intended usage. In that case the email and alerts are indeed very noisy. Luckily Firebase provides a way to stop these alerts. To stop the alerts you have to follow the following steps -

• Visit https://console.firebase.google.com/subscriptions/project/your-project-id
• Then you will get the following page -
• Here under the Realtime Database section you have to just untick the two boxes which are right to Your Realtime Database has insecure rules. The first box which is below In Firebase column will stop Firebase Console alerts and the second box which is below the column Email will stop receiving the alerts on email.

You can go through this document to know about Firebase Alerts.

You have to use firebase authentication.Then below code will work for you.

{
  "rules": {
    ".read": "auth.uid != null",
    ".write": false
  }
}

Otherwise you can use https://firebase.google.com/docs/remote-config

The culprit is the double quotes i think

{
  "rules": {
    ".read": auth.uid != null,
    ".write": false
  }
}