Upgraded a sample HMAC Custom Token Exchange demo to a real Firebase Authentication ID token, verified against Google's published JWKS instead of a shared secret, with email_verified gating to close an account-takeover path Firebase's default signup leaves open.
Also covers a "critical" adversarial-review finding that didn't hold up once checked against the live Auth0 tenant.