Firebase config in your bundle
Public by design. Your rules are what matter.
01
This is expected
Firebase web config — apiKey, authDomain, projectId, appId — is meant to be published. Google documents it that way. The API key identifies your project; it does not authorise access.
Access is decided entirely by your Firestore and Realtime Database security rules.
02
Where the real risk is
Test mode. A new Firebase project starts with rules that allow anyone to read and write, with an expiry date and a console warning. Plenty of live apps are still running on those rules, or on a copy of them with the expiry removed.
See the Firebase rules page for what to replace them with.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site