Why is it bad that my Firebase and MSG91 authorization data, including secret keys, have leaked?

[Miroff]

I recently discovered that an app from the Shopify App Store is exposing my API credentials (Firebase and MSG91 keys) publicly. This includes not just public keys but also private secret keys, which means anyone can:

• Send SMS messages or push notifications on behalf of my store without my consent.
• Wipe out my Firebase and MSG91 balances, as full access is exposed.
• Steal sensitive customer data if stored in Firebase.
• Use my credentials for malicious activities, leading to account suspensions or financial losses.

The app developers are dismissing the issue, claiming they only provide integration. However, this is a massive security vulnerability that affects all stores using this app.

What actions should I take?