mjml-head-breakpoint

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving the origin of the published artifact less independently verifiable.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions it in its README. The package may be a legitimate monorepo subpackage, but the supplied evidence does not directly verify that relationship, so publication provenance deserves review.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, making vulnerability-reporting expectations and response guidance less transparent.

Token permissionscaution

All three workflows lack top-level token-permission declarations, although none declares top-level write permissions; explicit least-privilege configuration would improve CI security hygiene.