I thought this discussion was already had on slack, but when you encode credentials for CI they are only decodable in the origin repo