Leaked secret · Database

Your Firebase Admin key
is exposed in .env?

Don't panic — but move fast. A committed or client-side FIREBASE_PRIVATE_KEY gives anyone admin access to your entire Firebase project — Firestore, Auth and Storage. Rotate it now, then make sure nothing else leaked.

Looks like
FIREBASE_PRIVATE_KEY=service-account JSON / -----BEGIN PRIVATE KEY-----

What an attacker can do with a leaked Firebase Admin key

⚠

Read/write all of Firestore and Realtime Database, ignoring security rules

⚠

Create, delete and impersonate any user in Firebase Auth

⚠

Access and wipe everything in Cloud Storage

Fix it right now — rotate your Firebase Admin key

  1. 1Google Cloud Console → IAM & Admin → Service Accounts → your Firebase admin SA → Keys → delete the leaked key, create a new one.
  2. 2Update the credentials in your server env and redeploy.
  3. 3Review Firestore/Auth/Storage audit logs for unfamiliar activity.
  4. 4Purge the service-account JSON from git history.

Removing the key from your latest commit isn't enough — it stays recoverable in git history until you scrub it. We do that (and find anything else you missed) in the free audit.

Not sure what else leaked? We'll scan your whole repo — free, in 48 hours.