mjml-validator

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving release-origin transparency weaker than best practice.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No SECURITY.md or equivalent security policy was found, reducing vulnerability-reporting transparency, though this is not evidence of unsafe code by itself.

Token permissionscaution

All three workflows lack top-level permissions declarations and none declares read-only permissions, which weakens least-privilege clarity even though no top-level write permissions were detected.

Type declarationscaution

No type declarations are included, which reduces TypeScript ergonomics for this JavaScript library, but this is a consumer convenience gap rather than evidence of abandonment or opaque maintenance.