storage.rules

rules_version = '2';

service firebase.storage {
  match /b/{bucket}/o {

    match /users/{userId}/{allPaths=**} {
      allow read: if true;
      allow create: if request.auth != null && request.auth.uid == userId;
      allow update: if false;
      allow delete: if request.auth != null && request.auth.uid == userId;
    }

    match /{allPaths=**} {
      allow read, write: if false;
    }
  }
}