mjml-column

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving release-origin transparency weaker than ideal.

Repo package mentioncaution

The repository name does not match mjml-column and its README does not mention the package, which creates some provenance ambiguity. However, the repository is a large MJML monorepo containing many component packages, so the mismatch is plausibly explained by monorepo organization rather than package piggy-backing.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security-scanning tools are reported; this is a transparency and assurance gap rather than evidence of abandonment.

Security policycaution

No repository security policy is present, reducing the transparency of vulnerability-reporting and response procedures.

Token permissionscaution

All three workflows lack top-level token permissions declarations, and none declares read-only permissions, leaving workflow privilege boundaries less explicit than ideal.