A couple of things I really think would help: The password reset and login form leaks account info in the network response. You should return the same network

A couple of things I really think would help: The password reset and login form leaks account info in the network response. You should return the same network response regardless of whether the user exists in the DB, instead of relying on the UI to communicate that. Logging into your site sends back the full account profile object, including the password 'hash', which appears to just be a Base64 encoded string. Fortunately the Firebase API redacts that field so the decoded string is just 'REDACTED', but that's not a good thing to rely on, and I hope the password is actually encrypted behind the scenes.. Both of these are unfortunately common mistakes you see even on more well known sites. Goodluck with everything.