mjml-table

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present. This reduces release transparency and reproducibility, though it is a caution rather than a health verdict by itself.

Repo package mentioncaution

The repository name does not match mjml-table and its README does not mention the package, which creates some uncertainty about package-to-repository linkage. However, the repository is a large MJML monorepo containing the package's broader project structure, so this is a caution rather than a severe mismatch.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools were detected. The established build process is positive, while the missing scanning capability is a transparency and hygiene gap.

Security policycaution

No repository security policy was found. This weakens vulnerability-reporting transparency, but active maintenance and other repository controls partially compensate.

Token permissionscaution

All three workflows lack top-level token-permission declarations, and none declares read-only permissions at the top level. This leaves workflow privilege boundaries less explicit and is a genuine CI security-hygiene concern.