Can Google Cloud Build Trigger Substitution Variables exposed publicly?

Question

In order to build my NextJS app, my Firebase Private Key is required at build time. Google Cloud Build has a feature called Substituting variable values.

I would like to know if there is a risk of someone being able to access this key publicly?

That is to assume I didn't write code that accidentally exposes the key.

Answer 1

I suggest you use Secrets Manager to store your private key. You're still passing it as an environment variable, but it's being done securely rather than you explicitly passing it as an env var directly.