diff --git a/.github/workflows/deploy-spaces.yml b/.github/workflows/deploy-spaces.yml
index 3b14fcfd54..2c7ef1705e 100644
--- a/.github/workflows/deploy-spaces.yml
+++ b/.github/workflows/deploy-spaces.yml
@@ -114,6 +114,11 @@ jobs:
         echo "js_tarball_url=https://gradio-builds.s3.amazonaws.com/${{ needs.changes.outputs.sha }}/$tarball_name" >> $GITHUB_OUTPUT
     - name: Install Hub Client Library
       run: pip install huggingface-hub==0.23.2
+      # temporary, but ensures the script cannot be modified in a PR
+    - name: Get deploy scripts
+      run: |
+        curl https://raw.githubusercontent.com/gradio-app/gradio/main/scripts/upload_demo_to_space.py -o scripts/upload_demo_to_space.py
+        curl https://raw.githubusercontent.com/gradio-app/gradio/main/scripts/upload_website_demos.py -o scripts/upload_website_demos.py
     - name: Upload demo to spaces
       if: github.event.workflow_run.event == 'pull_request'
       id: upload-demo
diff --git a/.github/workflows/deploy-website.yml b/.github/workflows/deploy-website.yml
index c97a75ae50..455d3520eb 100644
--- a/.github/workflows/deploy-website.yml
+++ b/.github/workflows/deploy-website.yml
@@ -14,6 +14,7 @@ concurrency:
   cancel-in-progress: true
   
 
+# these variables are not secret and are used to identify the Vercel project
 env:
   VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
   VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
diff --git a/.github/workflows/test-python.yml b/.github/workflows/test-python.yml
index 9ec4640401..d955293dbd 100644
--- a/.github/workflows/test-python.yml
+++ b/.github/workflows/test-python.yml
@@ -15,6 +15,8 @@ concurrency:
 
 env:
   NODE_OPTIONS: "--max-old-space-size=4096"
+  # this is a non-secret secret and provides read access to a set of spaces for testing purposes
+  # this secret has minimal permissions and only has access to things that can be made public
   HF_TOKEN: ${{ secrets.HF_TOKEN }}
 
 jobs:
diff --git a/.github/workflows/tests-js.yml b/.github/workflows/tests-js.yml
index 1f8deed1bb..00764052ce 100644
--- a/.github/workflows/tests-js.yml
+++ b/.github/workflows/tests-js.yml
@@ -13,8 +13,6 @@ env:
   CI: true
   PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
   NODE_OPTIONS: "--max-old-space-size=4096"
-  VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
-  VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
 
 concurrency:
   group: "${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}-${{ github.workflow_ref }}"