Auth sends unverified requests with release AppCheck provider

[Tarasovych]

Description

Having this code

class SimpleAppCheckProviderFactory: NSObject, AppCheckProviderFactory {
  func createProvider(with app: FirebaseApp) -> AppCheckProvider? {
    return AppAttestProvider(app: app)
  }
}

class AppDelegate: NSObject, UIApplicationDelegate, UNUserNotificationCenterDelegate, MessagingDelegate {
    func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey : Any]? = nil) -> Bool {
//...
#if DEBUG
            let providerFactory = AppCheckDebugProviderFactory()
#else
            let providerFactory = SimpleAppCheckProviderFactory()
#endif
            AppCheck.setAppCheckProviderFactory(providerFactory)
            FirebaseApp.configure()
    }

I can see 100% of unverified requests in AppCheck console for "Google Identity for iOS":

How it is possible?
When testing the app in DEBUG mode, there is no such issue

Reproducing the issue

No response

Firebase SDK Version

11.14

Xcode Version

16.2

Installation Method

Swift Package Manager

Firebase Product(s)

App Check

Targeted Platforms

iOS

Relevant Log Output

If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

    {
      "identity" : "firebase-ios-sdk",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/firebase-ios-sdk",
      "state" : {
        "revision" : "45d327fcbe7793747295346c2209ad419bdead74",
        "version" : "11.14.0"
      }
    }

If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

Replace this line with the contents of your Podfile.lock!

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[rizafran]

Hi @Tarasovych, I see that you're getting 100% unverified invalid requests. Please file a ticket to our Firebase Support so the team could check your project and API usage as well as to identify what's causing the invalid requests.

That being said, I'll go ahead and close this issue. Thanks.

[Tarasovych]

Thanks @rizafran