mjml-social

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving release provenance less independently verifiable despite the package's otherwise strong release history.

Repo package mentioncaution

The repository name does not match mjml-social and its README does not mention the package, which creates some uncertainty about the linkage. However, the repository is a large monorepo and the package artifact aligns with the MJML project structure, so this is a caution rather than a severe concern.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security-scanning tools were detected. The build setup is present, while the missing scanning coverage is a modest hygiene gap.

Security policycaution

No SECURITY.md or equivalent security policy was detected, reducing transparency about vulnerability reporting and response procedures.

Token permissionscaution

All three workflows lack top-level token permissions declarations, and none declares read-only permissions. This leaves least-privilege behavior less explicit, although no workflow has top-level write permissions.