Upload and hide your app secret to firebase before deploying to firebase hosting?

Avoid Committing .env to Version Control

Add the .env file to your .gitignore file to prevent it from being committed to your version control system:
.env

Use Firebase Functions to Access Secrets Securely

• If you have sensitive secrets that need to be used in your app, consider moving them to Firebase Functions. You can create secure cloud functions that your app can call to retrieve the necessary data without exposing secrets in the frontend.
•  Deploy your Firebase Functions with access to environment variables stored in Firebase.

Secure Firebase Config

• If you’re using Firebase, note that the Firebase config object (including the API key) is typically safe to expose in frontend code since Firebase uses it for identification rather than authentication. However, don’t use this API key for any other purpose.
• For additional security, you can restrict the API key to specific domains or use Firebase rules to secure your database and storage.

CI/CD Pipeline Secrets

• When deploying to Firebase Hosting, manage your secrets securely using environment variables in your CI/CD pipeline. Most CI/CD platforms like GitHub Actions, GitLab CI, and others provide ways to manage secrets.
• Make sure these secrets are not logged or printed during the build process.