I have found that firebase sensitive credentials like API_key, Database_url is displayed in Cleartext form while intercepting requests

All such details should not be present in Code in cleartext form there should be encryption or other mechanism to call api_key for processing because that data can be used by attacker to perform read and write on Firebase database without access control