> This means that simply by opening a pull request into the right repo, you can gain authorization to publish packages. Travis CI intentionally avoids this sor

> This means that simply by opening a pull request into the right repo, you can gain authorization to publish packages. Travis CI intentionally avoids this sort of vulnerability by never providing encrypted environment variables when running pull requests from forks: https://docs.travis-ci.com/user/encryption-keys/ https://docs.travis-ci.com/user/encryption-keys/ This is especially necessary because a pull request can make arbitrary code change, like "print the npm access token", which would then run as part of the test suite and show up in the public logs.