Firebase has a "rules" feature where you set up security/authorization rules on your database: https://firebase.google.com/docs/database/security#section-autho

Firebase has a "rules" feature where you set up security/authorization rules on your database: https://firebase.google.com/docs/database/security#section-authorization https://firebase.google.com/docs/database/security#section-a... There's a "development" mode you can enable on your database that simply ignores all of the rules. The college app either 1) has no/unsafe rules set up, or 2) left their Firebase database in development mode.