mjml-cli

Build provenancecaution

The release has no build attestation, trusted publisher identity, or staged publishing, leaving provenance less transparent and warranting caution.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security-scanning tools were detected; the missing scanning is a modest hardening gap.

Security policycaution

No repository security policy was found, reducing vulnerability-reporting transparency and leaving a genuine governance gap.

Token permissionscaution

All three workflows lack top-level permissions declarations and none declares read-only permissions, so least-privilege intent is not explicit even though no top-level write permissions were observed.