mjml-button

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving publication provenance less transparent despite the package's otherwise established release history.

Repo toolingcaution

The repository uses Babel and npm scripts, but no security scanning tools were detected. Build tooling is present; the missing security automation is a genuine transparency and risk-management gap.

Security policycaution

No repository security policy was found, reducing disclosure and security-maintenance transparency.

Token permissionscaution

All three workflows lack top-level permissions declarations, although none declares top-level write permissions and one uses job-level permissions. Explicit least-privilege configuration would be clearer, so this remains a workflow hygiene concern.