@firebase/database-compat

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving publication origin less independently verifiable. This is a transparency gap, not evidence that the release is unsafe.

Repo toolingcaution

The repository uses established build tools including TypeScript, Rollup, Webpack, Babel, and Nx. No security scanning tools were detected, a modest transparency gap partly offset by the separate security policy.

Workflow auditcaution

All 21 workflows were analyzed with no untrusted checkouts, script injection, broad top-level writes, or unpinned actions. A high-severity cache-poisoning finding had low confidence, while high-confidence adhoc package installation is a minor hygiene concern.