Secret keys shipped in the frontend in Firebase
criticalUpdated Oct 12, 2026
The Firebase web config (apiKey, projectId, and similar) is designed to live in the client. Security rules are the control.
Fix for Firebase
The Firebase web config (apiKey, projectId, and similar) is designed to live in the client. Security rules are the control. A service account JSON file is not the web config. It must not be imported by frontend code.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Firebase fixes are on the Firebase page.