Security
We moved our AI processing from the backend to Firebase AI Logic in our Flutter app so the backend no longer handles large image/audio uploads or waits for AI responses.
Free users get 10 AI actions per day. Premium users get unlimited actions.
Since AI requests now happen directly from the client, how do you securely enforce these different quotas? A determined user could potentially bypass a backend quota check and call Firebase AI Logic directly.
How are others handling this in production? Is there a recommended Firebase architecture for plan-specific quotas without routing the files and AI processing through a backend?
