#519 CI checkouts keep the read-only token in .git/config

[Anonymous]

Originally created by: athanclark

CI checkouts in ci.yml keep the token in .git/config.

ci.yml:25, 74, 143, 187, 231 and 412 omit persist-credentials: false. The token is read-only (permissions: contents: read), fork PRs get no secrets, and the Docker build context excludes .git/config (.dockerignore:24-33), so this is hygiene only.

---

From the security review of 2026-11-06 (commit 6776c44), finding I-18: hardening or information, filed publicly because it describes no way in. The exploitable findings are private security advisories.

🤖 Generated with Claude Code

https://claude.ai/code/session_011fFY8eruEi1xAkkMBni13B

[Anonymous]

Ticket changed by: athanclark

• status: open --> closed