{
  "phase": "L7-firebase-app-configs",
  "date": "2026-08-18",
  "operator_go": "Firebase configs (2026-08-18)",
  "mode": "read-only Firebase Management API + public misconfig probes",
  "target": "ptsc-marine Firebase project (PTSC Marine / Petrovietnam Technical Services)",
  "apps": {
    "android": {
      "appId": "1:499227356580:android:e3a6355f49f16e58de6531",
      "displayName": "akm_mobile (android)",
      "packageName": "com.fpt.akames.stma.ptsc",
      "api_key": "AIzaSyD-fPtI3QI15dqkOHQK6rtUjqyS3XYPeTs",
      "oauth_client": "EMPTY (no OAuth client IDs)",
      "storage_bucket": "ptsc-marine.firebasestorage.app"
    },
    "ios": {
      "appId": "1:499227356580:ios:280d9c9700c027e4de6531",
      "displayName": "akm_mobile (ios)",
      "bundleId": "com.fpt.akames.stma.ptsc",
      "api_key": "AIzaSyBQnEcWebTvbezWs0lqpKlyApeQY2jtTAY",
      "flags": "IS_SIGNIN_ENABLED=true, IS_GCM_ENABLED=true, IS_ANALYTICS_ENABLED=false"
    }
  },
  "product_identification": "akm_mobile = FPT akames STMA/PTSC mobile app (same akames MES platform as UAT DB dumped 2026-08-18; STMA and PTSC are client deployments of the same FPT product)",
  "misconfig_probes": {
    "storage_bucket_list": "404 Not Found (bucket does not exist; 0 buckets confirmed earlier)",
    "rtdb_public": "404 on both asia-southeast1 and firebaseio.com default hosts (RTDB never created)",
    "fcm_legacy_server_key": "NOT in client config (by design, client configs never hold server key)"
  },
  "assessment": {
    "api_keys_nature": "client-side keys embedded in APK/IPA by design; NOT secret per Firebase security model (relies on Security Rules + App Check)",
    "new_access_gained": "NONE beyond what SA keys already give",
    "confirmed_capability": "FCM push remains the ONLY actionable Firebase vector (both apps GCM-enabled, real user base on PTSC Marine)",
    "corroboration": "Firebase project is push+hosting only; no Auth/Firestore/RTDB/Storage = no data to steal via this channel"
  },
  "verdict": "Firebase recon COMPLETE. Only vector: FCM push phishing (gated — operator decision, third-party Petrovietnam, high detection).",
  "sysmod": "none — read-only API calls",
  "artifacts": "this file; raw configs fetched via /tmp/fb_config.py (cleaned)",
  "confidence": "CONFIRMED — direct API reads + public endpoint probes"
}