APK Reverse engineering Firebase information reading problem?

Question

I created a simple messaging app for Android. I worked a bit on reverse engineering issues to test application security. When I analyze my application with reverse engineering, Firebase project ID, App ID and API Key can be easily read. Can attackers access the database with this information?

Answer 1

Yes, they can.

You should use security rules in tandem with Firebase Authentication to protect the database in order to determine who exactly can read and write the database.

Since you didn't say which database you're using, you can read about security rules for bothFirestore and Realtime Database to determine what you need to do.