Firebase Security Rules control access to Firestore data. Rules follow allow read/write conditions based on request attributes. Match statement identifies to secure. Wildcards match dynamic path segments with documentId. Request.auth contains authenticated user information. Resource.data accesses document data for validation. Granular rules control read and write separately. Validate fields with type checking and value constraints. Prevent injection attacks by validating data structure. Time-based rules limit access windows. Rate limiting prevents abuse within transaction limits. Deny by default, allow specific access patterns. Function-based rules reuse validation logic across paths. Subcollection rules inherit from parent but can be overridden. Test rules in Firebase Console simulator before deployment. Monitor rule evaluation with Firebase Monitoring. Rules evaluation cost is calculated per operation. Complex validation should be in server code, not rules. Security rules are your application's first line of defense. Regular audit of rules prevents security gaps.