Should I rely on K6_CLOUD_TOKEN validation or explicit --out=cloud flag to prevent accidental public test exposure?

Preventing Accidental Public Access in k6 Cloud Tests

When running k6 load tests that target the cloud service, there's a risk of unintentionally exposing test scripts and results publicly. The k6 cloud command makes tests visible by default unless explicitly configured otherwise.

Two documented approaches exist for preventing this exposure: using the K6_CLOUD_TOKEN environment variable for secure authentication, or explicitly controlling output destinations via the --out flag.

The constraint is ensuring that local or CI/CD executions cannot accidentally publish tests to the public cloud dashboard. k6 v0.47.0+ introduced K6_CLOUD_TOKEN as the standard mechanism for authenticated cloud execution, while the --out=cloud flag provides explicit control over output destination. However, the behavior differs: setting K6_CLOUD_TOKEN to an empty or invalid value still allows local execution without public exposure, whereas omitting the flag entirely may trigger default cloud behavior.

Which approach provides stronger guarantees against accidental public exposure in automated environments?

1. Should I configure K6_CLOUD_TOKEN validation in CI/CD to ensure tests fail securely when the token is missing or invalid?
2. Is the --out=cloud flag alone sufficient to prevent accidental exposure, or should both mechanisms be combined?
3. How does the k6 cloud web UI's default public visibility interact with these configuration approaches?