mjml

Build provenancecaution

No build attestation or trusted publisher identity is present, leaving release provenance less independently verifiable. This is a supply-chain transparency caution, not evidence that the release is malicious.

Repo toolingcaution

The repository uses Babel and npm build tooling, showing an established build process. It has no security scanning tools, which is a modest security-hygiene gap.

Security policycaution

The repository has no security policy, reducing clarity about vulnerability reporting and response procedures. This is a transparency caution, though active maintenance provides some compensation.

Token permissionscaution

None of the three workflows declares top-level permissions, which is less explicit than a least-privilege configuration. However, no workflow has top-level write permissions, so this is a limited hygiene concern rather than a severe workflow risk.

Type declarationscaution

No type declarations are included, which can reduce TypeScript ergonomics for consumers. This is a usability gap rather than a material maintenance or abandonment concern.