Investigate Firebase Cloud Messaging legacy server key

Build 2.10 · Scan 2026-10-12T10:26:48.163Z

1 distinct recorded findings; 1 have inspectable metadata. Locations are representative, not an inventory of every source match.

A Firebase Cloud Messaging legacy server key. Anyone with it can send push notifications as the app to all its users — rotate it.

Static evidence does not establish runtime impact. Source excerpts and line numbers were not recorded.

Evidence preview

Evidence type

Static string match

Representative location

classes3.dex

Recorded match

•••••••• (40+ chars, redacted)

Detector rule

fcm_legacy_key

Recorded file locations