critical
private-key-pem· PEMPrivate key
Asymmetric private key material. For a Firebase or Google service account, this is full admin access to the project.
How it is detected
Matches a PEM private key header. When it appears inside a service-account JSON structure it is relabelled accordingly, because a Google service account key is full administrative access rather than just key material.
If you find one
- 1Revoke the credential with its provider. Rotation is the only fix — the key is in the browser cache, in CDN edge nodes, and in whatever scraped the page.
- 2Review the account for activity you did not initiate.
- 3Move the call that needed it to a server route, so the browser never receives the replacement.
Where it turns up
Most often in Firebase Admin credentials pasted into a client-side config file.