Restricting database access is one aspect of security with Firebase.

Much more interesting is the cross-site scripting problem. For example, firebase.com pulls in Javascript from Twitter and Google. Is Firebase safe from the other code on the same page?