Firestore Security Rules is allowing updates without an update rule
It’s possible I’m not understanding proper use of firestore sdk set() method. My understanding is that if a document id does not exist it will perform a “create”. If it does it will perform an “update” to the existing document and overwrite unless merge=True
is included. That’s not what I’m seeing however.