# simple: Firebase config env-only, service account wiped

Source: https://www.michaelchurley.com/blog/simple-firebase-env-only-sa-wiped  
Published: 2026-09-09  
Author: Michael C. Hurley  
Tags: simple, firebase, secrets, security, follow-up, michaelmonetized

![Firebase residue cleared from simple starter](/blog/simple-nextjs-firebase-auth-social-keep-decision/screenshots/residue-gaps.png)

## Who

Operators who cloned **michaelmonetized/simple** after the keep-Firebase decision and still had a hardcoded client config or a local service-account file sitting next to the tree.

If the prior post left Issue #7 open on firebase leftovers, this is the close.

## What

On **michaelmonetized/simple**, PR **#12** closed Issue **#7**.

Client Firebase is env-only now and fails closed when the env is missing. It does not log config values. serviceAccount / admin credential patterns are gitignored. A leftover local SA file was wiped from the working tree (it was never committed).

Pack had flagged hardcoded firebase leftovers. Those are gone from the tree.

## Where

Repo: **https://github.com/michaelmonetized/simple**  
PR: **https://github.com/michaelmonetized/simple/pull/12**  
Prior field notes: [/blog/simple-nextjs-firebase-auth-social-keep-decision](/blog/simple-nextjs-firebase-auth-social-keep-decision).

## When

**March 23, 2026:** keep-Firebase decision landed; residue (hardcoded config) still on the checklist.

**September 8, 2026 evening ET:** PR #12 merges. Issue #7 CLOSED.

## Why

A written keep-Firebase decision is not the same as a clean tree. Env-only client config and ignoring admin credential patterns close the security chapter the pack still listed.

Would you rotate any Firebase web keys that ever lived in git history, or redeploy simple-ivory next now that the residue is gone?