  #478
Description
The security rules for the usernames collection do not prevent users from registering reserved usernames such as admin, root, or support. While the client-side code has a check, it can be bypassed by interacting directly with the Firestore API, allowing an attacker to impersonate official accounts.
Originally posted by @gemini-code-assist[bot] in #469 (comment)