mjml-head-font

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing publication transparency; the active repository and npm publishing workflow provide some compensating process evidence but do not replace provenance.

Repo package mentioncaution

The repository name does not match mjml-head-font and its README does not mention the package, which creates a transparency concern about the package-to-repository relationship. The repository's monorepo structure and the package's MJML component documentation provide partial contextual compensation, so this remains caution rather than danger.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools are detected. The missing scanning is a genuine security-hygiene gap, though it is not evidence of abandonment.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations unclear.

Token permissionscaution

All three workflows lack top-level token permission declarations, and none declares read-only permissions. This weakens workflow least-privilege hygiene, although no top-level write permissions were detected.