mjml-divider

Build provenancecaution

No build provenance attestation or trusted publisher identity is available, reducing release transparency and making artifact origin harder to independently verify.

Repo package mentioncaution

The repository name does not match mjml-divider and its README does not mention the package, creating some linkage ambiguity. However, the repository is an organization-owned monorepo whose file tree visibly contains many component packages, which partly compensates for the mismatch.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools were detected. The build setup is established, while security-tooling coverage remains a gap.

Security policycaution

No repository security policy was found, which weakens vulnerability-reporting transparency and incident-response expectations.

Token permissionscaution

All 3 workflows lack top-level token permissions declarations, and none has read-only permissions reported. Although no top-level write permissions were detected, explicit least-privilege policy is not consistently documented.