# Token bake warning

Tag `v0.2.3-live-token` embeds a personal Xc-Token as `EXTERNAL_SERVICE_TOKEN` in the image layers and, once committed, git history. This is a security risk.

Set `ALLOW_LIVE_SUBMIT=0` to stop live submissions. Rotate the token if the repository or image is exposed.