Firebase config object posted on github

Question

I worked on a personal project for last few weeks, and used github asa the VCS, but now i want to make the project public so i have to ask the next thing.

I forgot to create an individual file for the firebase config object and add it to gitignore, so it is visible in the project if you search for it

var firebaseConfig = {
  apiKey: "API_KEY",
  authDomain: "PROJECT_ID.firebaseapp.com",
  databaseURL: "https://PROJECT_ID.firebaseio.com",
  projectId: "PROJECT_ID",
  storageBucket: "PROJECT_ID.appspot.com",
  messagingSenderId: "SENDER_ID",
  appId: "APP_ID",
  measurementId: "G-MEASUREMENT_ID",
};

The object contains this data, my question is, could i do anything to secure the firebase account so that when i publish the project there won't be problems with people trying to mess with my backend?

Or is there any other option?

Answer 1

In addition of resetting your key, you could use git filter-repo (see INSTALL) in order to rewrite all commits, changing the content of that version file with a blob callback.

You would replace apiKey: "..." by apiKey: "XXX".

git filter-repo --blob-callback '
    blob.data = blob.data.replace(b"yourKey", b"AN_ENVIRONMENT_VARIABLE")
'

That way, your code history is based on an environment variable name, instead of an old key value.

Answer 2

You can navigate to Google Cloud Credentials, there click on 'API Key'(Browser key probably) and in the top of the page you will have the option to reset the API key. The same goes for OAuth Client ID. After that, use those new credentials that you can find in firebase > project overview > project settings.

I suggest using environmental variables to hide your API Keys