Skip to content

Security: Firebase config values in NEXT_PUBLIC_ env expose project to direct API calls #770

Description

@anshul23102

Security Bug: Client-Exposed Firebase Config Without Firestore Security Rules Enforcement

Description

All Firebase configuration values are prefixed with NEXT_PUBLIC_FIREBASE_*,
embedding the API key, project ID, and app ID into the production JavaScript
bundle. While Firebase API keys are designed to be public, they are only safe
when Firestore security rules are correctly deployed. The repository's
firestore.rules file exists but has no automated deployment step in the
README or CI. A contributor who follows the setup guide without deploying rules
runs the app with Firestore in open-access test mode.

Steps to Reproduce

  1. Set up the project following the README without running firebase deploy --only firestore:rules.
  2. Extract the Firebase config from the browser bundle (search for apiKey).
  3. Use the Firebase SDK directly from the browser console:
    const db = getFirestore(initializeApp(extractedConfig));
    const snap = await getDocs(collection(db, "users"));
    snap.forEach(d => console.log(d.data()));
  4. Observe all user profile data is returned without authentication.

Root Cause

firestore.rules deployment is not automated. The README describes Firebase
setup but does not include firebase deploy --only firestore:rules as a
required step.

Impact

All Firestore collections (user profiles, events, wiki articles, open-source
project data) are publicly readable and writable by anyone with the config.

Proposed Fix

Add a predeploy hook in firebase.json that always deploys security rules,
and add a CI step that validates rules are deployed before the app goes live.

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions