1. Verified architecture
The archive contains Firebase Authentication, Firestore, Storage, Cloud Functions, App Check and Messaging integrations. Firestore and Storage rules use authenticated family membership and role checks. Callable functions can enforce App Check based on environment. Secret parameters are referenced through Firebase Functions configuration rather than embedded provider keys.
2. Data scope and permissions
Rules and application controllers represent family-scoped access, administrator/member/caregiver permissions, owner-scoped private memory and server-owned collections for invitations, rate limits and external intake. Presence in code does not prove that every deployed rule matches the supplied repository.
3. Documents and uploads
Storage rules limit family documents to PDF, JPEG and PNG with a maximum size of 10 MB, require verified email and membership, and require matching pending metadata before upload. Avatar uploads have a separate JPEG and size policy.
4. Functions and external processing
Functions include rate limiting, bounded provider responses, authentication, membership checks, invitation workflows, notification triggers, account deletion and scheduled maintenance. External email/SMS intake uses configured webhook secrets and server-side routing. Production secret rotation and endpoint security must be verified.
5. Observability and notifications
The client contains an observability layer and runtime recovery paths. Messaging and generic notification policies exist. A buyer should verify log redaction, retention, alerting, crash reporting, support access and notification content before production use.
6. Known caveats
- The archive alone cannot prove the current deployed Firebase configuration.
- Some evidence documents report rules compilation or dry-run rather than full emulator behaviour.
- Device and background audio/privacy states remain open in project documentation.
- Final penetration testing, dependency review, threat modelling and incident response are not proven.
- No claim of complete security or compliance is made.
7. Recommended buyer checks
- Recreate cloud infrastructure under buyer-controlled accounts.
- Rotate all secrets and verify App Check enforcement by environment.
- Run Firestore/Storage emulator tests and end-to-end permission tests.
- Audit dependencies, functions, logs, retention and deletion.
- Perform mobile platform, privacy and security testing before launch.