Off topic, since this site uses firebase: For firebase one has to include the API keys and other info in the JS itself. I think that this is just another mong

Off topic, since this site uses firebase: For firebase one has to include the API keys and other info in the JS itself. I think that this is just another mongo DB like hack waiting to happen. Becuase a lot of developers might not know how to configure firebase read, write access rules properly. So as far as I understand anybody determined enough should be able to read the JS and read and write(!!) to other people's data. Is there something I am missing here?