@firebase/app-check

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, leaving publication origin less independently verifiable despite the project's active backing.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so the package-to-repository relationship is not explicit; the monorepo structure provides context but does not remove that transparency gap.

Repo toolingcaution

The project uses established build tools and has a repository security policy; no automated security-scanning tool was detected, which is a modest transparency gap.

Version stabilitycaution

Version 0.13.1 is not a prerelease, but 75% of recent releases were prereleases, so users should expect a less settled 0.x API surface.

Workflow auditcaution

All 21 workflows were analyzed, all 106 action references are pinned, and permissions are read-only or job-scoped. A high-confidence low-severity finding notes an ad hoc package install, while the low-confidence cache finding is hygiene rather than a material risk.