Fixes #41
You can view the security issue in this report.

Solution

I removed the rule ".write": "auth !== null && auth.provider === 'github'" from v1/users, and hardened the write rule under v1/users/$uid so a user can only write to its own uid.

In addition, I removed the read rule from /v1/users/$uid, since it was useless because of the ".read": "auth !== null && auth.provider === 'github'" under /v1/users.

From what I saw, the current functionality needs to read all the users, therefore I left it permissive rule.

Note: I didn't removed the problem from the old API, in order not to break anything.

An analysis on the fixed rules can be seen here.