title: Insecure Firestore rules and App Check - the right way to go for unauthenticated database access?
body: <p>I have built an app (Android/iOS) using Flutter that allows its users to configure the app to receive a daily notification. Users can also submit a textfield. There is no requirement for users to register and authenticate.</p>
  <p>I am using Firestore to store data from the app.</p>
  <p>I have architected the app so that the Firestore rules allow any access:</p>
  <pre><code>rules_version = '2';
  service cloud.firestore {
    match /databases/{database}/documents {
      match /{document=**} {
        allow read, write: if true;
      }
    }
  }
  </code></pre>
  <p>To prevent anyone accessing my app's Firestore instance, I have implemented App Check, and Enforcement is enabled.</p>
  <p>I have begun to get messages from Google '[Firebase] Your Cloud Firestore database has insecure rules'.</p>
  <p>Can anyone advise:</p>
  <ol>
  <li>Should I ignore the warnings from Google?</li>
  <li>Must I implement user registration and authentiation when it's not necessary for the app?</li>
  <li>Should I architect my app in a different way?</li>
  <li>Should I do something else?</li>
  </ol>
  <p>Thanks,</p>
  <p>Luke</p>