diff --git a/config/test.js b/config/test.js
index b7e134b..7c69fd7 100644
--- a/config/test.js
+++ b/config/test.js
@@ -10,6 +10,11 @@ main();
 
 function main() {
   const options = parseArgs();
+  if (isForkedPrFullRun(options)) {
+    printForkedPrFullRunErrorMessage();
+    process.exitCode = 1;
+    return;
+  }
   const printVerboseResults = options.mode === "FULL";
   const runOptions = {printVerboseResults};
   const tasks = makeTasks(options.mode, options.limitMemoryUsage);
@@ -33,6 +38,37 @@ function parseArgs() {
   return options;
 }
 
+/**
+ * Check whether we're running full CI for a PR created on a fork. In
+ * this state, Circle CI omits secure environment variables (which is
+ * good and desired), but this means that we'll have to abort tests.
+ */
+function isForkedPrFullRun(options) {
+  if (options.mode !== "FULL") {
+    return false;
+  }
+  if (!process.env["CIRCLE_PR_NUMBER"]) {
+    // This environment variable is only set on forked PRs.
+    // https://circleci.com/docs/2.0/env-vars/#built-in-environment-variables
+    return false;
+  }
+  if (process.env["SOURCECRED_GITHUB_TOKEN"]) {
+    return false;
+  }
+  return true;
+}
+
+function printForkedPrFullRunErrorMessage() {
+  console.error(
+    [
+      "fatal: cannot run full test suite: missing credentials",
+      "Tests on forked PRs run without credentials by default. A core team ",
+      "member will sanity-check your PR and push its head commit to a branch ",
+      "on the main SourceCred repository, which will re-run these tests.",
+    ].join("\n")
+  );
+}
+
 function makeTasks(
   mode /*: "BASIC" | "FULL" */,
   limitMemoryUsage /*: boolean */