mjml-core

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving publication provenance less transparent than ideal.

Repo toolingcaution

The repository uses build tooling through Babel and npm scripts, but no security-scanning tools are reported, leaving a security-hygiene gap.

Security policycaution

No repository security policy is present, reducing transparency around vulnerability reporting and response expectations.

Token permissionscaution

All three workflows lack top-level token permissions declarations, and none declares read-only permissions; although no workflow has top-level write permissions, explicit least-privilege configuration would be safer.