security-rule.json

{  
  "rules": {
    "reviewsLogin": {
      ".read": true,
      ".write": true
    },
    "reviews": {
      ".read": true,
      ".write": true
    },
    "reviewsSecure": {
      ".read": true,
        ".write":true,
      "$reviews_secure_id": {
      	".read": true,
        ".write": "auth.uid == root.child('reviewsSecure').child($reviews_secure_id).child('user_id').val()"
      }
        
    }
  }
}

To only read user's data (disallow user to view his/her friend's data)

Change rules to:

"reviewsSecure": {
      ".read": true,
      "$reviews_secure_id": {
      	".read": "auth.uid === root.child('reviewsSecure').child($reviews_secure_id).child('user_id').val()",
        ".write": "auth.uid === root.child('reviewsSecure').child($reviews_secure_id).child('user_id').val()"
      }
    }```