From 2aa0311bd4f3b3422f2fb74d969d98e54e1745f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kyle=20=F0=9F=90=86?= <kyle@privkey.io>
Date: Sat, 1 Aug 2026 10:31:54 -0400
Subject: [PATCH] Keep the job token out of a tree the PR author controls

---
 .github/workflows/ci.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2e5ea28..e3d8898 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -57,6 +57,12 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v6
+        with:
+          # This job checks out a PR branch and then EXECUTES a script from it.
+          # actions/checkout persists GITHUB_TOKEN into .git/config by default,
+          # leaving it readable by PR-authored code. Nothing here needs git
+          # credentials.
+          persist-credentials: false
       - name: Check for silent RNG fallbacks
         run: ./scripts/check-rng-hygiene.sh