And travis, circle-ci, etc do this for the same reason - any forker could hack the ci config file on the PR branch to steal your creds