Security Bug: Client-Exposed Firebase Config Without Firestore Security Rules Enforcement
Description
All Firebase configuration values are prefixed with NEXT_PUBLIC_FIREBASE_*,
embedding the API key, project ID, and app ID into the production JavaScript
bundle. While Firebase API keys are designed to be public, they are only safe
when Firestore security rules are correctly deployed. The repository's
firestore.rules file exists but has no automated deployment step in the
README or CI. A contributor who follows the setup guide without deploying rules
runs the app with Firestore in open-access test mode.
Steps to Reproduce
- Set up the project following the README without running
firebase deploy --only firestore:rules.
- Extract the Firebase config from the browser bundle (search for
apiKey).
- Use the Firebase SDK directly from the browser console:
const db = getFirestore(initializeApp(extractedConfig));
const snap = await getDocs(collection(db, "users"));
snap.forEach(d => console.log(d.data()));
- Observe all user profile data is returned without authentication.
Root Cause
firestore.rules deployment is not automated. The README describes Firebase
setup but does not include firebase deploy --only firestore:rules as a
required step.
Impact
All Firestore collections (user profiles, events, wiki articles, open-source
project data) are publicly readable and writable by anyone with the config.
Proposed Fix
Add a predeploy hook in firebase.json that always deploys security rules,
and add a CI step that validates rules are deployed before the app goes live.
Security Bug: Client-Exposed Firebase Config Without Firestore Security Rules Enforcement
Description
All Firebase configuration values are prefixed with
NEXT_PUBLIC_FIREBASE_*,embedding the API key, project ID, and app ID into the production JavaScript
bundle. While Firebase API keys are designed to be public, they are only safe
when Firestore security rules are correctly deployed. The repository's
firestore.rulesfile exists but has no automated deployment step in theREADME or CI. A contributor who follows the setup guide without deploying rules
runs the app with Firestore in open-access test mode.
Steps to Reproduce
firebase deploy --only firestore:rules.apiKey).Root Cause
firestore.rulesdeployment is not automated. The README describes Firebasesetup but does not include
firebase deploy --only firestore:rulesas arequired step.
Impact
All Firestore collections (user profiles, events, wiki articles, open-source
project data) are publicly readable and writable by anyone with the config.
Proposed Fix
Add a
predeployhook infirebase.jsonthat always deploys security rules,and add a CI step that validates rules are deployed before the app goes live.