mjml-navbar

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving release origin and reproducibility less transparent. This is a genuine supply-chain hygiene gap, but not evidence of an unhealthy project by itself.

Repo package mentioncaution

The repository name does not match mjml-navbar and its README does not mention the package, which creates some uncertainty that the repository is the package's actual source. However, the repository tree clearly contains multiple MJML component packages, so the mismatch is plausibly explained by monorepo organization.

Repo toolingcaution

The repository uses Babel and npm scripts for builds, but no security-scanning tools were detected. The missing security automation is a moderate hygiene gap, partially offset by the mature build setup.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures. This is a caution rather than a severe risk because other maintenance signals are strong.

Token permissionscaution

All three workflows lack top-level permissions declarations, and none explicitly declares read-only permissions. Although no workflow has top-level write permissions and one has job-level permissions, explicit least-privilege configuration would be preferable.