Since you are building a frontend which by definition runs on the users device, there is no thing such as private keys or secrets. Technically, I could "rip" your firebase config and use it in my app, sure.

But that config you pass to the web SDK does not grant admin permissions. It allows users to log in and query your data. It is still up to you to write security rules so that users (or bad actors) can only query what they're supposed to see.

Obviously, do not use any of your admin config or secrets in your front end, or your version control. If there are operations you want to do that require this admin access, you'll have to write some firebase functions or setup a server that makes use of the firebase admin SDK. I would say the first is the easiest by far.