What are Firestore security rules?

Firestore Security Rules are a declarative language for defining access controls on your Firestore database. They run server-side and prevent unauthorized reads/writes. Rules are defined in the Firebase console or a firestore.rules file. Structure: rules_version = '2'; service cloud.firestore { match /databases/{database}/documents { match /users/{userId} { allow read: if request.auth != null; allow write: if request.auth.uid == userId; } } }. Key concepts: (1) request.auth — contains the authenticated user's UID, email, and custom claims; (2) resource.data — the current document data; (3) request.resource.data — the incoming data being written; (4) Match rules — patterns with wildcards match paths; (5) Allow operations — read (get + list), write (create + update + delete), or granular: get, list, create, update, delete. Rules default to deny all — you must explicitly grant access.