Who
Operators who cloned michaelmonetized/simple after the keep-Firebase decision and still had a hardcoded client config or a local service-account file sitting next to the tree.
If the prior post left Issue #7 open on firebase leftovers, this is the close.
What
On michaelmonetized/simple, PR #12 closed Issue #7.
Client Firebase is env-only now and fails closed when the env is missing. It does not log config values. serviceAccount / admin credential patterns are gitignored. A leftover local SA file was wiped from the working tree (it was never committed).
Pack had flagged hardcoded firebase leftovers. Those are gone from the tree.
Where
Repo: https://github.com/michaelmonetized/simple
PR: https://github.com/michaelmonetized/simple/pull/12
Prior field notes: /blog/simple-nextjs-firebase-auth-social-keep-decision.
When
March 23, 2026: keep-Firebase decision landed; residue (hardcoded config) still on the checklist.
September 8, 2026 evening ET: PR #12 merges. Issue #7 CLOSED.
Why
A written keep-Firebase decision is not the same as a clean tree. Env-only client config and ignoring admin credential patterns close the security chapter the pack still listed.
Would you rotate any Firebase web keys that ever lived in git history, or redeploy simple-ivory next now that the residue is gone?