Project ID: meeings-acc6e (Aura Notes)
Ticket Reference ID: ZH4ATUO7HEX2U3633LN6LOUSLU
Suspension reason: account hijacked (compromised credentials)
Suspended since: September 4, 2026
Appeal history (all under the same ticket):
- Appeals submitted: Sept 12, Sept 25, Oct 7, Oct 12 (plus Sept 5 original)
- Follow-up emails to the compliance address: Sept 9, Sept 10
- Each submission produced only an automated "Appeal Received" email.
No human response or request for more information in 41 days.
Root causes found and fixed:
1. API keys were committed to Git history of a private repository.
History was cleaned and the keys were deleted.
2. A config file containing an API key was bundled as a plain asset in
the published Android app. The asset has been removed from the app
source and the key was deleted. A new release will not include it.
3. Local tooling access was reduced: Firebase CLI access was revoked
from the Google account, and no service account key files exist on
the development machine.
4. All keys used by the app were rotated or deleted; the app no longer
depends on client-side API keys in the next release.
Not yet done (blocked because the console is inaccessible):
- OAuth client secret rotation
- Audit of unauthorized resources and API key restrictions
Impact: the production Android app (com.leejungbeom.meeings_app) on
Google Play is unusable. Auth, Firestore, and Cloud Functions are
suspended, and a Play data-deletion/privacy URL had to be moved to
another site because Firebase Hosting is down.
Request: Could a staff member please check the status of this ticket or
tell me what additional information is needed? I will not open another
appeal while this one is under review.
