I have a working web application with Firebase authentication. I want it to be such that only I (via the Firebase console) can set up accounts and anybody can sign into the accounts that I’ve set up. Every account in this app can access the same data, no matter the account, and I have setup Firestore rules to only accept requests that are authenticated.

The root of the problem is that I do not know much about the best practices of Firebase, but to get to the point, what is preventing someone from running auth.createUserWithEmailAndPassword("email", "password") in the browser console, logging into that account, and gaining access to the data?