Broken Object Level Authorization

A generated read-then-write lets both requests spend the same balance

A dev.to walkthrough of AI-written Firebase code argues the dangerous defects sit in the architecture, and its examples are a balance update two concurrent requests can both pass and a rule that admits any signed-in user.