mjml-head-style

Build provenancecaution

No registry build attestation or trusted publisher provenance is available, which reduces publication transparency and warrants a modest caution.

Repo package mentioncaution

The repository name does not match the package and its README does not mention mjml-head-style, which creates uncertainty about package-to-repository traceability. The mismatch is consistent with a monorepo, but the absence of a README mention still warrants caution.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools were detected. The missing security automation is a hardening gap and merits caution.

Security policycaution

No SECURITY.md or equivalent security policy was detected, leaving vulnerability-reporting procedures unclear and creating a transparency gap.

Token permissionscaution

All three workflows lack top-level token permissions declarations, although none declares top-level write permissions and one uses job-level permissions. This is a workflow-hardening gap rather than evidence of unsafe behavior.