firebase

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving release provenance less transparent than it could be. This is a transparency gap, not evidence that the release is unsafe.

Maintainerscaution

Three of four publishing accounts use the Google domain, consistent with the organization-backed repository. The feiyang.chen account uses gmail.com, which is a minor publishing-account hygiene concern rather than evidence of limited maintenance capacity.

Repo toolingcaution

The repository uses established build tools including TypeScript, Rollup, Webpack, Babel, and Nx. No security-scanning tools were detected, which is a modest process gap, while a security policy is present separately.