mjml-image

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving release provenance less transparent than it could be.

Repo package mentioncaution

The repository name does not match mjml-image and its README does not mention the package, which creates a package-to-source transparency concern. The repository file tree clearly shows a large component monorepo containing many mjml packages, partially explaining the mismatch but not the absent README mention.

Repo toolingcaution

The repository uses Babel and npm scripts for builds, but reports no security scanning tools. The missing scanning is a hygiene gap, not evidence of abandonment.

Security policycaution

No repository security policy was found, which reduces transparency around vulnerability reporting and response expectations.

Token permissionscaution

None of the three workflows declares top-level token permissions, and none is reported as read-only. This weakens CI permission hygiene even though no top-level write permissions were detected.