fixed it by creating firebase-config.js, which now handles all API keys securely. added firebase-config.js.example for users who want to run it locally ...