Firebase deployment uploads .secret.local

[nomagick]

Firebase deployment uploads .secret.local .

When the application is breached somehow, the file may be leaked unexpectedly.
(it happened)

So could you at least add this particular file to default ignore?
Or just simply load the .gitignore and respect that?

Even this file is not leaked to a third-party, it does not mean the user agrees to share it with Google.

Can't believe I'm reporting this to Google in 2024.

[nomagick]

Or just ignore *.local as it says local ?

[aalej]

Hey @nomagick, thanks for the feedback. Sorry to hear you’ve encountered this issue. I do agree that this is something that we could improve on so that secret values are not leaked.

Being an open source community, feedback coming from our fellow developers helps us polish our product better, and we appreciate that you brought this to our attention.

Let me try to bring this up to our engineering team to discuss what can be improved here.