mjml-carousel

Build provenancecaution

No build provenance attestation or trusted publisher identity is provided, leaving publication integrity less transparent even though this is not by itself evidence of an unhealthy project.

Repo package mentioncaution

The repository name does not match mjml-carousel and its README does not mention the package, creating a provenance and ownership-transparency concern. The repository's substantial monorepo structure and package-oriented tree partially explain the name mismatch but do not establish an explicit README mention.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools were detected; the build setup is present while security-tooling coverage remains a hygiene gap.

Security policycaution

No repository security policy was found, which reduces transparency around vulnerability reporting and response procedures.

Token permissionscaution

All three workflows lack top-level permissions declarations, although none declares top-level write permissions and one uses job-level permissions. Explicit least-privilege defaults would improve workflow hygiene.