Secret scanning gives false positive for Google Firebase API key

[boocockp]

Select Topic Area

Product Feedback

Body

Web apps that use Google Firebase need to embed a unique API key in the client code just to identify which app is being used. This is flagged by secret scanning, but it has to be sent in clear to every user of the app, and it is not used for authentication or to control access. Google documentation says it is not intended to be secret.
More info at https://firebase.google.com/docs/projects/learn-more#config-files-objects

[setoelkahfi]

Can someone from GitHub chime in? We're currently considering whether to put effort into hiding the Firebase API key from our .plist file.

[SPodjasek]

As nobody from GitHub has picked this up, I guess I'll have to close those issues as false positives giving reference to this page: https://firebase.google.com/support/guides/security-checklist#api-keys-not-secret