We are using sbt-coveralls for an open source company project and I just got notified from our security team that the repo_token field inside of the coveralls.json file constitutes a security risk, especially when combined with sbt-github-actions since it will place the coveralls.json file inside of an archive that gets cached.
We are using sbt-coveralls for an open source company project and I just got notified from our security team that the
repo_token
field inside of thecoveralls.json
file constitutes a security risk, especially when combined with sbt-github-actions since it will place thecoveralls.json
file inside of an archive that gets cached.Is it possible to remove this field entirely?