Authorisation

Every plan lives at a path named after its owner's account ID, so the path itself is the ownership check — there is no field to tamper with.

Read access is granted to the owner, and to invited viewers whose email address Google has verified. Write access is granted to the owner alone. Every other path in the database is denied by default.

Verification

The rules are covered by an automated test suite run against the Firestore emulator on every change.
Cross-user reads, signed-out reads, collection listing and unverified email addresses are all tested as denials, not assumed.
The same checks have been exercised against the live database with real accounts.

Identity

Sign-in uses Google. Waypoint never handles a password. Sessions are stored in your browser and end when you sign out.

Sharing is keyed to verified email addresses only, so an address cannot be claimed by simply typing it during sign-up.

Keys and transport

The Firebase key in the page is a public project identifier, not a secret. It is additionally restricted to this site's domains, so it is refused when used from anywhere else.

All traffic is served over HTTPS.

Reporting a problem

If you find a security issue, stop testing at the point you can demonstrate it and report it before sharing it publicly. Please do not access data belonging to anyone else.