# Is there really a need to protect the Codecov upload token?

**URL:** <https://community.codecov.com/t/is-there-really-a-need-to-protect-the-codecov-upload-token/877>\
**Category:** Support\
**Created:** [January 10, 2020, 11:27pm UTC](https://community.codecov.com/t/is-there-really-a-need-to-protect-the-codecov-upload-token/877 "2020-01-10T23:27:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ggilley](https://avatars.discourse-cdn.com/v4/letter/g/7993a0/32.png) [@ggilley](https://community.codecov.com/u/ggilley)\
**Post date:** [January 10, 2020, 11:27pm UTC](https://community.codecov.com/t/is-there-really-a-need-to-protect-the-codecov-upload-token/877/1 "2020-01-10T23:27:56Z")

</div>

Is there a reason to protect the Codecov upload token?

What I read on the site says it’s “required to identify which project the coverage belongs to”. The only worry I see is that someone could upload bogus results.

It’s a private source code repo, so if it gets out, I have much worse problems that someone being able to add bogus results to codecov. Is there anything I’m missing?

Thanks,

```
   Greg
```

---

<div class="post-metadata">

**Author:** ![drazisil](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/drazisil/32/496_2.png) [@drazisil](https://community.codecov.com/u/drazisil)\
**Post date:** [January 13, 2020, 3:13pm UTC](https://community.codecov.com/t/is-there-really-a-need-to-protect-the-codecov-upload-token/877/2 "2020-01-13T15:13:22Z")

</div>

You are correct that the only risk would be someone uploading incorrect coverage.

The warning is in place because it is needed in some cases for public repos if I recall. For a private repo you have less need for concern.