mjml-head

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is recorded, leaving release-origin verification weaker than it could be.

Repo package mentioncaution

The repository name does not match mjml-head and its README does not mention the package, creating package-to-repository transparency uncertainty. The repository is clearly structured as a multi-package project, which partly explains the name mismatch but does not fully resolve the missing mention.

Repo toolingcaution

The repository uses Babel and npm scripts for builds, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures.

Token permissionscaution

All three workflows lack top-level token permissions, and none declares read-only permissions; this weakens least-privilege workflow hygiene even though no top-level write permissions were detected.