mjml-text

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving release-origin verification weaker than it could be.

Repo package mentioncaution

The repository name does not match mjml-text and its README does not mention the package, creating some uncertainty about the exact package-to-repository linkage; the monorepo structure is a partial contextual explanation but does not fully remove the gap.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security-scanning tools are reported, leaving a modest security-process gap.

Security policycaution

No repository security policy is present, reducing transparency around vulnerability reporting and response expectations.

Token permissionscaution

All three workflows lack top-level token permissions declarations, and only one uses job-level permissions, so least-privilege configuration is not consistently explicit.