mjml-hero

Build provenancecaution

No build attestation or trusted-publisher provenance is present, which weakens release transparency even though it is not evidence of unhealthy maintenance on its own.

Repo package mentioncaution

The repository name does not match mjml-hero and its README does not mention the package. Although a monorepo name mismatch is ordinary for subpackages, the lack of an explicit mention creates some uncertainty that this repository directly backs the release.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools were detected; the missing security automation is a modest transparency gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations and security governance less explicit.

Token permissionscaution

All 3 workflows lack top-level permissions declarations, although none declares top-level write access and one has job-level permissions. This is a workflow-hardening gap rather than evidence of active unsafe behavior.