mannprerak2
commented
4 years ago Hi @AbhishekDoshi26
- For starters, simply removing the file in a commit doesn't remove it from the git repository, someone can clone the repo, go back to a previous commit, and would be able to get the file again. Read this if you wanna know how to remove a file completely from a git repository.
- The google-services.json file is not really a secret, it's easily extractable from an APK, and it can be used against If the rules haven't been set properly. Currently, only the Read permission is public, and Write permission is disabled for everyone, so no one can misuse this file. Read this.
Uploading google-services.json will allow others to access your firebase account along with the Firebase Bucket. This is because google-services.json has some secret information like Bucket Public URL using which anyone can use it and further change the rules of your firebase.