try with secure variable

.appveyor.yml

@@ -66,7 +66,9 @@ environment:
   DATALAD_TESTS_SERVER_SSH_SECKEY: /home/appveyor/.ssh/datalad_tests_id_rsa
   DATALAD_TESTS_SERVER_SSH_PATH: /usr/local/apache2/htdocs
   DATALAD_TESTS_SERVER_LOCALPATH: /home/appveyor/DLTMP/sshdroot
-
+  # codecov token
+  CODECOV:
+    secure: Hk/tBmm/WkGzKPKl92aLKap2/FWJMTi9ioRNeADvn/23X7FTOwPuwc0svsLNbk3A
   # Do not use `image` as a matrix dimension, to have fine-grained control over
   # what tests run on which platform
   # The ID variable had no impact, but sorts first in the CI run overview
@@ -334,7 +336,7 @@ for:
       - "curl -Os $CODECOV_BINARY"
       - chmod +x codecov
       # the do-upload subcommand seems to work for the codecov-cli and legacy uploader
-      - ./codecov do-upload -t e7a6a2a5-c06d-4ac7-af27-834d72c5634c
+      - ./codecov do-upload -t $CODECOV
 
     on_finish:
       # conditionally block the exit of a CI run for direct debugging