Or using your paid repository to story their own app data. The authentication credentials are running on the client. I'm wondering how I keep a troll from writing a billion things to my firebase.