mjml-section

Build provenancecaution

No build attestation or trusted publisher provenance is present, leaving the relationship between source and published artifact less independently verifiable.

Repo package mentioncaution

The repository name does not match mjml-section and its README does not mention the package, which creates some uncertainty about package-to-repository linkage. The package's placement in a substantial organization-owned repository tree partially compensates for this monorepo mismatch.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security-scanning tools were detected; the latter is a transparency and vulnerability-management gap.

Security policycaution

No repository security policy was detected, so vulnerability-reporting and response expectations are less transparent.

Token permissionscaution

All three workflows lack top-level permissions declarations, although none declares top-level write permissions and one uses job-level permissions; explicit least-privilege configuration would be preferable.