firebase-master

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The service-worker example uses importScripts to fetch and execute remote JavaScript at runtime from https://www.gstatic.com/firebasejs/10.7.1/firebase-app-compat.js and https://www.gstatic.com/firebasejs/10.7.1/firebase-messaging-compat.js, which are runtime-fetched external scripts that execute code and are presented as required for the push-notifications flow.