I'm creating an android app which uses the Firebase real-time database.
I have the firebase project limited to Google Signins, and the database limited to only authenticated users.
The app has been deployed to Internal Testing in the Google Play Store, but it's not in production yet. The Internal Testing of the app is limited to only 1 email address.
In firebase I'm seeing many unfamiliar gmail accounts authenticating with my firebase project (23 in the past week). They all have the format firstname.lastname.10000@gmail.com. I am assuming these are bot accounts.
Does anyone know how these accounts are authenticating with my firebase project even though my android app hasn't been released yet? Is there a security setting in firebase I'm missing or some other way to block them?
I'm thinking of writing a script that will check every hour or so and disable/delete them, but that seems like I'm fixing the symptom and not the problem.