@firebase/database-types

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less independently verifiable despite the package's active organization-backed project.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, which creates some package-to-repository ambiguity. Because the repository is the Firebase organization monorepo, the mismatch is plausibly normal for a sub-package but remains a transparency caution.

Workflow auditcaution

All 21 workflows were analyzed with no untrusted checkout or script-injection findings, all 106 action references are pinned, and permissions are read-only or job-scoped. The high-severity cache-poisoning result has low confidence; the high-confidence adhoc-packages finding is a minor hygiene concern.