Hiding an admin page URL is not security. Any visitor can discover it. The real requirement is to verify identity on the server and repeat the authorization check for every write operation.

Firebase Authentication identifies the user. Once the ID token is verified by the server, an HttpOnly session is created only for an account on the admin allowlist. Browser JavaScript cannot read that cookie.

Direct browser access to Firestore is denied. Project and post changes go through protected server endpoints, creating an actual authorization layer instead of a hidden button.