First-party (i.e. Google). Tricked in the sense I was asked to do a security assessment and didn't check what differential changes had been made

edit: correct!