Treat download URLs like shared links, not permission checks. If a file must stay private, keep it under a path only its owner can read and do not hand the URL out.

Context: A Firebase Storage download URL includes a token that grants read access no matter what your storage rules say afterwards. Locking down the rules later does not kill URLs already in circulation. The only way to revoke one is to rotate the object download token in the Firebase console.