Will It Vibe?Checkout persists credentials in the workspace
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
actions/checkout is configured with persist-credentials: true, which writes the job token into .git/config. Any later step (including third-party actions or PR code) can read it from there and use it against the repository.
Why it matters
actions/checkout with persist-credentials: true (the default) writes the job token into .git/config so later git commands can authenticate. Any subsequent step can read that file, including third-party actions and, in privileged triggers, pull request code. That turns a token meant for one checkout into one available to everything after it.
How to fix it
Set persist-credentials: false on checkout unless a later step genuinely needs to push with the same token. When you do need to push, pass a scoped token explicitly to just that step instead of leaving it in .git/config for the whole job.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo