{
  "rules": {
    ".read": false,
    ".write": false,

    "check": {
      ".read": "auth != null",
      ".write": "auth != null && newData.exists()",
      ".validate": "newData.hasChildren(['salt','marker'])"
    },

    "vault": {
      ".read": "auth != null",
      ".write": "auth != null && newData.exists()",
      ".validate": "newData.hasChildren(['iv','ct'])"
    },

    "columns": {
      ".read": "auth != null",
      ".write": "auth != null && newData.exists()"
    },

    "backups": {
      ".read": "auth != null",
      "$dia": {
        ".write": "auth != null && !data.exists() && newData.exists()",
        ".validate": "newData.hasChildren(['ts','vault'])"
      }
    }
  }
}