mjml-accordion

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving release provenance less verifiable than it could be.

Repo package mentioncaution

The repository name does not match the package and its README does not mention mjml-accordion, which creates a caution that the package's repository association is not explicit. The repository file tree does contain packages/mjml-accordion, partially supporting the association but not eliminating the metadata gap.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security-scanning tools were detected. The missing scanning coverage is a modest transparency and assurance gap.

Security policycaution

The repository has no security policy, reducing transparency around vulnerability reporting and response expectations.

Token permissionscaution

All three workflows lack top-level permissions declarations, although none declares top-level write permissions and one uses job-level permissions. Explicit least-privilege declarations would provide stronger assurance.