@react-native-firebase/app

Lifecycle scriptscaution

A prepare install-time script is present. This is worth reviewing because it can affect installation behavior, although the broader package structure and active project evidence provide context for a build-oriented package.

Repo bus factorcaution

Although 10 contributors were active, the top contributor made 76.4% of recent commits, creating concentration risk. The organization-owned repository and continued activity from other contributors partly mitigate, but do not eliminate, this concern.

Security policycaution

No SECURITY.md or equivalent security policy was found, reducing vulnerability-reporting transparency for a widely used package.

Token permissionscaution

One workflow lacks top-level permissions and 11 workflows declare top-level write permissions, which is weaker least-privilege hygiene than ideal. The presence of three read-only workflows and the absence of untrusted checkouts provide partial context but do not remove the concern.