Firebase Service Account Key Fix: Secure Your Vibe-Coded App

Quick answer

If you've leaked a Firebase service account key in a vibe-coded app, you need to immediately revoke the key in Google Cloud Console, rotate any related credentials, and remove the key from your codebase and git history. Then, enforce strict secret management (environment variables, secret manager) and add automated scanning to prevent future leaks. Acting fast minimizes the risk of account takeover and data breach.

What to check first

Before you panic, follow this checklist to assess the damage and contain the leak:

Step-by-step fix

Follow these steps to fix the leaked Firebase service account key and harden your app.

1. Revoke the leaked key

2. Remove the key from your codebase and git history

# Install git-filter-repo
git filter-repo --path serviceAccountKey.json --invert-paths

3. Use environment variables or a secret manager

Never hardcode service account keys. Instead, store them in environment variables or a secret manager like Google Secret Manager.

export GOOGLE_APPLICATION_CREDENTIALS=/path/to/your/serviceAccountKey.json

Or better, store the JSON content in an env var:

// In your app
const serviceAccount = JSON.parse(process.env.FIREBASE_SERVICE_ACCOUNT);
admin.initializeApp({
  credential: admin.credential.cert(serviceAccount),
});

const { SecretManagerServiceClient } = require('@google-cloud/secret-manager');
const client = new SecretManagerServiceClient();
const [version] = await client.accessSecretVersion({
  name: 'projects/my-project/secrets/firebase-service-account/versions/latest',
});
const creds = JSON.parse(version.payload.data.toString());
admin.initializeApp({ credential: admin.credential.cert(creds) });

4. Add automated scanning

Prevent future leaks by integrating a secret leak scanner into your CI/CD pipeline. OverMCP can scan your repositories and detect exposed keys before you deploy.

5. Rotate keys periodically

Even if you don't suspect a leak, rotate your service account keys every 90 days to reduce risk.

Common mistakes

Vibe-coded apps often make these mistakes that lead to leaked Firebase service account keys:

Why vibe-coded apps are especially at risk

AI coding tools like Cursor, Bolt.new, and Replit Agent can generate boilerplate that includes placeholder credentials or accidentally include keys in code snippets. They may also scaffold projects without proper .gitignore rules, making it easy to commit secrets. Additionally, vibe coders often skip security best practices to ship fast, leaving keys exposed. Using a free AI app security scanner can catch these issues early.

Long-term prevention

Beyond immediate fixes, adopt these habits:

FAQ

How do I know if my Firebase service account key is leaked?

Search your codebase and git history for serviceAccountKey or .json files with private keys. You can also use a secret leak scanner to scan your repos automatically. Additionally, check Google Cloud audit logs for unexpected usage.

Can I just delete the key and generate a new one?

Yes, but also ensure you remove the key from your codebase and git history. Simply generating a new key doesn't stop an attacker who has the old one from using it until you revoke it. Always revoke the leaked key first.

What should I do if the leaked key was used to access user data?

Immediately rotate all related credentials, assess the breach scope, and notify affected users if their data may have been exposed. Consider informing regulatory bodies if required by law. Then, follow the steps above to prevent recurrence.

---

Don't let a leaked Firebase service account key derail your launch. Use OverMCP's continuous security monitoring to keep your vibe-coded apps safe.