Unexpected Firestore rules added for non-existent random collections with public read/write access

[TheDescar]

Can we access your project?

• I give permission for members of the FlutterFlow team to access and test my project for the sole purpose of investigating this issue.

Current Behavior

Firebase currently contains the rules above, while the current FlutterFlow Rules Preview does not contain these collections.

After making a change to Firestore Rules in FlutterFlow, for example setting my user collection to Exclude, FlutterFlow reports that the rules are Out of Date.

The deployment diff then appears to remove these unexpected rules from Firebase.

This suggests that these rules may have been added by an earlier FlutterFlow Firestore Rules deployment or remained from an older generated ruleset.

Expected Behavior

FlutterFlow should not generate or deploy Firestore rules for collections that:

do not exist in the FlutterFlow schema,
were not explicitly created by the developer,
and especially should not create random collection names with:
allow read, write: if true;

If these collections are internally generated by FlutterFlow, their purpose should be documented and they should not receive unrestricted public access unless absolutely required.

Steps to Reproduce

Create/use a FlutterFlow project connected to Firebase.
Deploy Firestore Rules from FlutterFlow.
Check the deployed rules in:
Firebase Console > Firestore Database > Rules
Compare them with:
FlutterFlow > Firestore > Rules Preview
Look for rules referencing collections that do not exist in the FlutterFlow schema.

Reproducible from Blank

• The steps to reproduce above start from a blank project.

Bug Report Code (Required)

no code

Visual documentation

Environment

- FlutterFlow version: 
- Platform:
- Browser name and version:
- Operating system and version affected:

Additional Information

I noticed that the Firestore Security Rules currently deployed in my Firebase project contain rules for two collections that do not exist anywhere in my FlutterFlow project or Firestore database:

kd2f5bhx
zb3v4u8e

The deployed Firebase rules contain:

match /kd2f5bhx/{document} {
allow create: if true;
allow read: if true;
allow write: if true;
allow delete: if true;
}

match /zb3v4u8e/{document} {
allow create: if true;
allow read: if true;
allow write: if true;
allow delete: if true;
}

These collections:

do not exist in Firestore Data
do not exist in my FlutterFlow Firestore schema
do not appear in the current FlutterFlow Firestore Rules Preview
are not collections I intentionally created

The rules are especially concerning because they grant completely unauthenticated create, read, update, and delete access.