There are over 100k firebase authentication files on public GitHub repos

11 points·stackola··8 comments

Exibit A: https://github.com/search?q=filename%3Agoogle-services.json&type=Code

also amusing: https://github.com/search?q=%22delete+google-services.json%22&type=Commits

Embedding Firebase and running client-side operations is the concept of Firebase itself, you create an API key for your app and put it in google-services.json. It's a public+non-secret file.

Yes you're right, I was under the impression those were more confidential. Still, having 100k firestore url's can't be good, given how hard is is to correctly secure firestore. Also using similar queries, you can try looking for the definitely-not-public serviceAccountKey.json

This literally comes with every website using Firebase with the configuration in the Javascript, what's you point?

Take there 800 admin service account keys instead

https://github.com/search?q=filename%3AserviceAccountKey.jso...

Yep, this is bad though.

It's hard to avoid. My project has a firebaseConfig.js.sample file committed as a reminder to the deployer, they need to create their own. And I put firebaseConfig.js into .gitignore in case a developer is careless.

exposed .env files. First result, lol https://github.com/DennisIrimu/instagram/blob/d49ea53281904c...

I’d love to try it out but don’t want to get in trouble!

Reply on news.ycombinator.com