Service account keys are sensitive
A service account JSON file contains an RSA private key. Anyone who obtains that key may be able to act as the service account within the permissions granted to it.
How the tester handles the key
The browser sends the JSON to the site's serverless send endpoint for the requested notification. The endpoint validates the fields, creates a signed OAuth assertion in memory, exchanges it for a short-lived access token, submits the FCM message, and does not write the credential to an application database or file.
Use least privilege
Use a dedicated service account with only the permissions required for FCM testing where practical. Never commit service account JSON files to a public Git repository. Rotate a key immediately if you believe it has been disclosed.
Production architecture
For production application servers, prefer Google-recommended workload identity or managed credentials when available. This site is intended as an interactive testing utility, not as a credential-storage service.