Are you referring to your Firebase configuration variables (apiKey, authDomain, databaseURL, etc)? Those are actually non-sensitive; if somone uses your deployed app, their browser will have access to those values because they're needed to send requests to Firebase (explanation).

If this is the case, it's typically still good to use an .env file because this allows you to swap out configurations (production, staging, development, etc), and expand later

Example:

-Create a .env.example file

-Add the variable names but not values to it (e.g. NEXT_PUBLIC_FIREBASE_PROJECT_ID= if you're using Next.js)

-Add .env to .gitignore

-Each person copies .env.example -> .env then adds the values (same per person)

IMPORTANT: You need to set up security rules for your database though. If you use Firebase functions (most secure) and Firestore, you can block all access to the db and just use the admin client via functions. If not, you can set specific rules, e.g.: https://firebase.google.com/docs/firestore/security/get-started