> with no custom server-side code at all Could be a mix. Firebase also offers Firebase Functions which are callable functions in the cloud. That code is not pu

> with no custom server-side code at all Could be a mix. Firebase also offers Firebase Functions which are callable functions in the cloud. That code is not public. However, Firestore or Firebase realtime database both require the user to setup security rules. Otherwise all data can be read by anybody.