.coveralls.yml is only needed for coveralls.io if you are using travis-ci.com (commercial travis for private repos).
You are using a public github repo, and so your .coveralls.yml is PUBLIC.
That REPO_TOKEN is meant to be a secret, by exposing it you allow anyone to write data to your coveralls.io.
If you remove .coveralls.yml then your results can still be written from travis-ci.org to coveralls.io as long as they both have access via your github account.
I will create a PR to fix this.
For more information please see
lemurheavy/coveralls-public#208
.coveralls.yml is only needed for coveralls.io if you are using travis-ci.com (commercial travis for private repos).
You are using a public github repo, and so your .coveralls.yml is PUBLIC.
That REPO_TOKEN is meant to be a secret, by exposing it you allow anyone to write data to your coveralls.io.
If you remove .coveralls.yml then your results can still be written from travis-ci.org to coveralls.io as long as they both have access via your github account.
I will create a PR to fix this.
For more information please see
lemurheavy/coveralls-public#208