From 40857ea0e8b892881a7c019562a5f3f2e88dc787 Mon Sep 17 00:00:00 2001
From: Anish Sujanani <anish.sujanani@postman.com>
Date: Mon, 7 Sep 2026 11:59:10 +0530
Subject: [PATCH] Set persist-credentials: false on actions/checkout

actions/checkout persists the GITHUB_TOKEN in .git/config by default. Setting persist-credentials: false removes it, as defence in depth against a later step exposing it via an artifact, a log, or a dependency script. See PM_GH_REPO_036.
---
 .github/workflows/postman.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/postman.yaml b/.github/workflows/postman.yaml
index 842b908..2bf047e 100644
--- a/.github/workflows/postman.yaml
+++ b/.github/workflows/postman.yaml
@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@v4