security: move Firebase config to GitHub secrets

- Replace hardcoded API key with build-time placeholders
- Store all Firebase config values as GitHub repo secrets
- Update deploy workflow to inject secrets via sed at build time
- Create new Firebase project (wordcloud-app-v2) with fresh credentials
- Add dev.sh for local development with firebase-config.local.js
- Old project (wordcloud-live) should be deleted manually in Firebase console

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: alfredang

.firebaserc

@@ -1,5 +1,5 @@
 {
   "projects": {
-    "default": "wordcloud-live"
+    "default": "wordcloud-app-v2"
   }
 }

.github/workflows/deploy-pages.yml

@@ -24,6 +24,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Inject Firebase config
+        run: |
+          sed -i \
+            -e 's|__FIREBASE_API_KEY__|${{ secrets.FIREBASE_API_KEY }}|g' \
+            -e 's|__FIREBASE_AUTH_DOMAIN__|${{ secrets.FIREBASE_AUTH_DOMAIN }}|g' \
+            -e 's|__FIREBASE_DATABASE_URL__|${{ secrets.FIREBASE_DATABASE_URL }}|g' \
+            -e 's|__FIREBASE_PROJECT_ID__|${{ secrets.FIREBASE_PROJECT_ID }}|g' \
+            -e 's|__FIREBASE_STORAGE_BUCKET__|${{ secrets.FIREBASE_STORAGE_BUCKET }}|g' \
+            -e 's|__FIREBASE_MESSAGING_SENDER_ID__|${{ secrets.FIREBASE_MESSAGING_SENDER_ID }}|g' \
+            -e 's|__FIREBASE_APP_ID__|${{ secrets.FIREBASE_APP_ID }}|g' \
+            firebase-config.js
+
       - name: Setup Pages
         uses: actions/configure-pages@v5
 

.gitignore

@@ -6,3 +6,4 @@ node_modules/
 .firebase/
 firebase-debug.log
 ui-debug.log
+firebase-config.local.js

dev.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+# Local development script
+# Copies firebase-config.local.js over firebase-config.js temporarily,
+# starts a server, then restores the placeholder version on exit.
+
+cp firebase-config.js firebase-config.js.bak
+cp firebase-config.local.js firebase-config.js
+
+cleanup() {
+  mv firebase-config.js.bak firebase-config.js
+  echo "Restored firebase-config.js placeholders"
+}
+trap cleanup EXIT
+
+echo "Starting local dev server at http://localhost:8080"
+python3 -m http.server 8080

firebase-config.js

@@ -1,15 +1,17 @@
 /* =============================================================
    FIREBASE CONFIGURATION
-   Auto-generated from Firebase CLI for project: wordcloud-live
+   Values are injected at build time by GitHub Actions.
+   For local development, create firebase-config.local.js with
+   your actual credentials (it's gitignored).
    ============================================================= */
 const FIREBASE_CONFIG = {
-  apiKey: "AIzaSyARkc7ebEtCW9jYqUdtbZevDg3lL9F0YVE",
-  authDomain: "wordcloud-live.firebaseapp.com",
-  databaseURL: "https://wordcloud-live-default-rtdb.firebaseio.com",
-  projectId: "wordcloud-live",
-  storageBucket: "wordcloud-live.firebasestorage.app",
-  messagingSenderId: "223206575168",
-  appId: "1:223206575168:web:755550cfd674905aa463a5"
+  apiKey: "__FIREBASE_API_KEY__",
+  authDomain: "__FIREBASE_AUTH_DOMAIN__",
+  databaseURL: "__FIREBASE_DATABASE_URL__",
+  projectId: "__FIREBASE_PROJECT_ID__",
+  storageBucket: "__FIREBASE_STORAGE_BUCKET__",
+  messagingSenderId: "__FIREBASE_MESSAGING_SENDER_ID__",
+  appId: "__FIREBASE_APP_ID__"
 };
 
 /* =============================================================
@@ -19,7 +21,7 @@ let firebaseApp = null;
 let firebaseDB = null;
 
 function isFirebaseConfigured() {
-  return FIREBASE_CONFIG.apiKey && !FIREBASE_CONFIG.apiKey.startsWith('YOUR_');
+  return FIREBASE_CONFIG.apiKey && !FIREBASE_CONFIG.apiKey.startsWith('__');
 }
 
 if (isFirebaseConfigured()) {
@@ -32,4 +34,5 @@ if (isFirebaseConfigured()) {
   }
 } else {
   console.log('[WordCloud] Firebase not configured — using localStorage sync (same-browser only)');
+  console.log('[WordCloud] For local dev, create firebase-config.local.js with your credentials');
 }

index.html

@@ -103,6 +103,12 @@ <h3>Edit Question</h3>
 <!-- Firebase SDK (Realtime Database for cross-device sync) -->
 <script src="https://www.gstatic.com/firebasejs/10.14.1/firebase-app-compat.js"></script>
 <script src="https://www.gstatic.com/firebasejs/10.14.1/firebase-database-compat.js"></script>
+<!--
+  Firebase config loading order:
+  1. firebase-config.js (has placeholders, replaced by CI at deploy time)
+  2. For local dev: rename firebase-config.local.js to firebase-config.js
+     or use the local dev server script below
+-->
 <script src="firebase-config.js"></script>
 <script src="app.js"></script>
 </body>