[JonDevOps]

The security rules for mentorships, tutorships, and pairings allow any authenticated user to create a document with any other user as a member, as long as the creator is also included in the memberIds. This allows an attacker to create 'fake' connections or overwrite existing ones, gaining access to the associated subcollections (tasks and notes) without the other user's consent.

Originally posted by @gemini-code-assist[bot] in #469 (comment)