> which is fair as I think we'd have to escalate pretty far up in Firebase to get the attention of someone who could alert project owners.

This begs the question, isn't this a security vulnerability after all?