Firebase service account / private key exposed in your app: how to fix it
Critical
A PEM private key block or a service-account JSON ("type": "service_account") in front-end code is admin-level access: Firebase Admin SDK credentials bypass all Security Rules.
Why it matters
AI tools sometimes import firebase-admin or a credentials JSON into client code when the regular Firebase SDK hits a permission error.
Quick fix
- Delete the key: Google Cloud Console → IAM & Admin → Service Accounts → Keys.
- Remove the JSON file and firebase-admin from client code.
- Use the regular Firebase web SDK in the browser, protected by Security Rules.
- Run admin tasks only in Cloud Functions or another server.
Step by step
1. Delete the key
Google Cloud Console → IAM & Admin → Service Accounts → select account → Keys → delete the exposed key. Create a new one only for your server, stored as a secret.
2. Fix the architecture
The browser uses the Firebase web config (apiKey, projectId, etc.), which is public by design. Admin SDK code belongs in Cloud Functions or your own backend.
3. Audit
Check Cloud Logging / audit logs, Firestore data, Auth users and Storage for unexpected changes.
Prompt for your AI builder
Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.
A Google service-account private key / firebase-admin credentials are bundled into my front end. Remove firebase-admin and any service-account JSON from client code. Use only the Firebase web SDK in the browser. Move any admin operations into a Cloud Function that verifies the caller's Firebase ID token. Then write Firestore and Storage security rules so users can only access their own documents.FAQ
I deleted the key from my code. Am I safe now?
No. Once a key has shipped to browsers it should be treated as public. It is in old deployments, caches and anyone's saved copy of your JavaScript. Revoke it at the provider and create a new one; removing it from code only stops future leaks.