How to use Firestore Security Rules perfectly - firebase

Question

I read the documentation and watched the video about this
but still not understanding perfectly
I mean I know how to write those security rules
but when should I use this?
do I have to write out all Security Rules for all the collections and documents? (if do so, it`s gonna be huge)
for instance, I`m making random dating app right now.
in my situation, I think I would not be so concerned about security unless I'm concerned with the payment system.
If I do not set up security rules for all documents, are all those documents in danger? (unsecured ones)

Answer 1

Unless you want anyone on the internet to be able to read and write any document in your database, you will need to use security rules to protect them. Whether or not this is going to be a problem for you, it's impossible to tell. But the possibility exists.

Answer 2

Go through this step by step then you will know how to use rules this
Basic Rules
Our Firestore security rules for Fogo, our image-sharing app, are as follows:
service cloud.firestore {
match /databases/{database}/documents {
match /uploads/{document=**} {
allow write: if request.auth.token.admin == true ;
allow read;
}
​
match /users/{document=**} {
allow read, write: if request.auth.token.admin == true ;
}
}
}
Let's break these rules down line-by-line.
service cloud.firestore — defines the service, in this case it's cloud.firestore
match /databases/{database}/documents — defines the database; the {database} clause indicates that these rules apply to all Firestore databases on the project
match /uploads/{document=**} — creates a new rules block to apply to the uploads collection and all documents contained therein
allow write: if requests.auth.token.admin == true ; — allows write access for authenticated sessions with an admin attribute equal to true on the auth token, which is also known as the user's JWT
allow read; — allows public read access
match /users/{document=**} - creates a new rules block for the users collection and all documents contained therein
allow read, write: if request.auth.token.admin == true ; - allows both read and write access for authenticated sessions with an admin attribute equal to true on the auth token, which is also known as the user's JWT