Hardcoded Firebase API key found

[marnixbent]

Hi,

I just stumbled across this line where I found (potentially live ) hardcoded API details for firebase. Take care!

kage/lib/firebase.js

Line 7 in 7efb4e3

apiKey: "AIzaSyDYXNe8SruSoEgaWWXyiIgZmGBm2xCleQ4",

[saltycrane]

Hi Marnix, thank you for alerting me to this. This scared me, but I just looked at the Firebase documentation and it says it is ok to include API keys in the code:

Unlike how API keys are typically used, API keys for Firebase services are not used to control access to backend resources; that can only be done with Firebase Security Rules (to control which users can access resources) and App Check (to control which apps can access resources).

Usually, you need to fastidiously guard API keys (for example, by using a vault service or setting the keys as environment variables); however, API keys for Firebase services are ok to include in code or checked-in config files.

from https://firebase.google.com/docs/projects/api-keys#api-keys-for-firebase-are-different