Search code examples
flutterfirebasegithubapi-key

Firebase android and ios API keys compromised on github

I am working on a flutter chat app on android and ios.

Unfortunately, I pushed my full working folder to my GitHub repository and later on received an email from GitHub that my API keys are compromised.

After I looked online, I found out that Firebase API keys are not secret, thus it doesn't matter exposing them.

Is this true? In the case that it's not, can anyone explain to me what to do? Thank you in advance!

Solution

  • Is always recommended to do not share any keys on public directories.
    You probably got this warning email because your repository is public
    Some recommendations for projects that are having secret keys are the following

    1. Make the GitHub repository Private
    2. Include the file path that has the key in the .gitignore file so it will not committed to the repository