Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Firebase

Exposed .env files and debug endpoints in Firebase

criticalUpdated Oct 12, 2026

A downloaded service account JSON in the repo or in public/ is a server credential. Rotate it in Google Cloud credentials if it was exposed.

Fix for Firebase

A downloaded service account JSON in the repo or in public/ is a server credential. Rotate it in Google Cloud credentials if it was exposed. The Firebase web config object is different and is expected in client apps.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Firebase fixes are on the Firebase page.