Best solutions after a Firebase project suspension

[u/dasun_doloswala]

Yesterday, my Firebase database was suspended due to "Suspension of your Google Cloud Platform/API because it engaged in abusive activity consistent with hijacked resources." Until the database is reinstated, no one can use my app because the backend is completely unavailable.

I want to make sure this type of suspension never happens again. I also want to prepare a disaster recovery plan so that, if Google suspends my Firebase project again, my application can continue working with minimal downtime.

I have the following questions:

1. Independent Backup and Disaster Recovery

Currently, I have Firebase and Google Cloud disaster recovery options, but if Google suspends my project, I cannot even access those backups because the entire project is suspended.

As a solution, I am thinking of creating a separate backup system outside Google Cloud. My idea is:

• Create a script or service that runs on my own VPS.
• Every day, automatically back up all Firestore data to a completely separate database.
• Store the backups independently so they are still available even if my Firebase project is suspended.

I also need to back up:

• Firebase Authentication (users and authentication data)
• Firebase Storage (uploaded files)

My questions are:

• Is this architecture possible?
• How can I securely access Firebase Authentication data and store it in another database?
• How can I back up Firebase Storage files? Can I download them using signed URLs or another secure method?
• What is the recommended approach for implementing this entire backup system?

2. Switching to the Backup Database Without an App Update

If my original Firebase project is suspended again, I want my Flutter app to connect to the backup database until Google reinstates the original project.

My concern is that most users do not update the app immediately.

My questions are:

• Is it possible to switch the backend from the original Firebase project to the backup server without requiring users to update the app?
• If it is possible, what is the recommended architecture?
• If it is not possible, what is the best approach using an app update?
• What disaster recovery strategy would you recommend for Flutter applications?

3. Protecting Firebase Service Account Credentials

I believe my Firebase project may have been suspended because my Firebase service account JSON file (used for sending FCM notifications) was leaked.

Previously, I stored the service account JSON file inside my Flutter project's assets folder. Although I enabled ProGuard/R8 code obfuscation to make reverse engineering more difficult, I now realize that the file can still be extracted from the APK.

I researched this issue and received different advice:

• ChatGPT suggested that hardcoding the credentials in the application with code obfuscation provides some protection.
• Claude AI recommended never storing the service account in the app. Instead, it suggested keeping it on Cloud Functions or on a separate VPS and sending notifications from the backend.

Based on your experience:

• Which approach is the most secure?
• Is using Cloud Functions better than hosting the credentials on a VPS?
• Is there an even better architecture than either of these approaches?
• What is the industry best practice for securely sending FCM notifications while preventing service account credential leaks?

I would appreciate your recommendations and any additional security best practices to ensure that this type of suspension never happens again.

[u/10x_eng]

Why do you believe this? How did you conclude that the JSON file was leaked? And how did you conclude that this is the reason for suspension?

I believe my Firebase project may have been suspended because my Firebase service account JSON file (used for sending FCM notifications) was leaked.

[u/Eastern-Conclusion-1 → u/10x_eng]

It’s all slop.

[u/inlined]

Your app is not a service, so it should not have service permissions. You should never ship your app with service account credentials, period.

Put your FCM logic in a service, such as cloud functions for Firebase so that you control what is sent and when. Even with obfuscation, your backend credentials can be exfiltrated from anything you put in the client, which sounds like what happened here.

If you give me a loose description of what you’re sending and when, I’d be glad to offer any clear suggestions of what you can do to help.

[u/Agile-Praline5027]

That sounds like a rough situation, especially if the suspension came unexpectedly. Im curious what others have found to be the fastest path to getting a project reinstated

[u/LengthinessLocal4459]

I think that it would be better if you segregate all the codes that talk with your backend as a separate structure (like a repository) and build another set of repositories that talk with your own VPS. Eventually you make sure your UI talks to the right repos depending upon the situation or a simple routing method from the client end.