mjml-raw

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, limiting publication transparency and reproducibility.

Repo package mentioncaution

The repository name does not match mjml-raw and its README does not mention the package, which creates some uncertainty about the package-to-repository link. The monorepo structure partly explains the name mismatch but does not remove the missing README reference.

Repo toolingcaution

The repository uses Babel and npm scripts, but no security scanning tools are reported. The build setup is present, while the missing security automation is a transparency gap.

Security policycaution

No repository security policy is present, reducing the project's documented vulnerability-reporting transparency.

Token permissionscaution

All three workflows lack top-level permissions declarations, and only one uses job-level permissions. Although no top-level write permissions were found, explicit least-privilege configuration is incomplete.