Skip to main content
Lynkz’s security model depends on Firestore rules to control exactly what data clients can read and write. Because Lynkz uses the Firebase client SDK in the browser — and the NEXT_PUBLIC_FIREBASE_* config values are intentionally public — Firestore rules are the primary layer that prevents unauthorised access to sensitive fields. This page provides the full ruleset, explains what each rule does in plain language, and shows you how to deploy them.

​
The Rules

Paste these rules into your Firestore configuration before going to production:

​
What Each Rule Does

pages/{username} Anyone on the internet can read a page document — this is what powers your public profile. Writes are allowed from the client (so your dashboard can save changes), but any write that attempts to include a PIN hash or recovery email field is rejected outright. Those fields can only be written by the server using privileged credentials. analytics/{username} and analytics/{username}/daily/{day} Analytics data is write-only from the client perspective — this lets the server log page views and link clicks. No client can read analytics documents, keeping your traffic data private. lockouts/{id} Lockout records are completely inaccessible to clients. Only the Vercel serverless functions that handle login attempts can read or write this collection, preventing clients from reading or clearing lockout state. magic_tokens/{token} Magic link tokens are completely inaccessible to clients. Token generation and validation happen exclusively in serverless functions, so a token can never be read or forged from the browser.

​
Sensitive Field Stripping

Firestore rules are the first line of defence, but Lynkz also strips sensitive fields server-side as a second layer. Before any page data reaches the browser, the following fields are removed from the response:
  • pinHash
  • email
  • updatedAt
  • createdAt
This means even if a rule misconfiguration ever occurred, these fields would still not reach the browser.

​
Applying the Rules

You can deploy the rules using either method:

​
Firebase Console

1

Open your Firebase project

Go to console.firebase.google.com and select your project.
2

Navigate to Firestore Rules

Go to Firestore Database → Rules.
3

Paste the rules

Replace the existing rules with the block above.
4

Publish

Click Publish to deploy the rules immediately.

​
Firebase CLI

This uses the firestore.rules file in the root of the repository. Make sure you’re authenticated (firebase login) and have the correct project selected (firebase use <project-id>).
These rules must be applied before going to production. Running Lynkz without them leaves your entire Firestore database — including PIN hashes, recovery emails, and analytics — openly readable and writable by anyone with your Firebase config.