diff --git a/appveyor.yml b/appveyor.yml
index 0401a1e8..fe97a9fd 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -15,6 +15,9 @@ install:
 - ps: $env:DOTNET_SKIP_FIRST_TIME_EXPERIENCE = "true"
 - dotnet tool install --global dotnet-sonarscanner
 
+# https://www.appveyor.com/docs/build-configuration/#secure-variables
+# However, secure variables are not decoded during Pull Request builds which prevents someone from submitting PR with malicious build script displaying those variables. In more controlled environment through with a trusted team and private GitHub repositories there is an option on General tab of project settings to allow secure variables for PRs.
+# See also https://medium.com/@stef.heyenrath/how-to-fix-sonarcloud-issue-in-a-github-pr-when-using-appveyor-integration-8909b49406b4
 environment:
   PATH: $(PATH);$(PROGRAMFILES)\dotnet\
   COVERALLS_REPO_TOKEN:
@@ -22,14 +25,18 @@ environment:
   SONAR_TOKEN:
     secure: guog1+ttdnlD8sVgvizlewksm3qbO7dy2oZUcR8WhurWYvdOByinxXo732hmSaMT
 
+
 before_build:
 - dotnet restore .\src\WireMock.Net\WireMock.Net.csproj
 - dotnet restore .\src\WireMock.Net.Standalone\WireMock.Net.Standalone.csproj
 - dotnet restore .\test\WireMock.Net.Tests\WireMock.Net.Tests.csproj
 
+
 build_script:
-# build WireMock.Net with SonarScanner
-- dotnet sonarscanner begin /k:"wiremock" /d:sonar.organization="stefh-github" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.login="%SONAR_TOKEN%" /v:"%APPVEYOR_BUILD_NUMBER%" /d:sonar.cs.opencover.reportsPaths="%CD%\coverage.xml"
+# Begin SonarScanner
+- ps: 'if (-Not $env:APPVEYOR_PULL_REQUEST_NUMBER) { & dotnet sonarscanner begin /k:"wiremock" /d:sonar.organization="stefh-github" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.login="$env:SONAR_TOKEN" /v:"$env:APPVEYOR_BUILD_NUMBER" /d:sonar.cs.opencover.reportsPaths="$env:CD\coverage.xml" }'
+
+# build WireMock.Net
 - dotnet build .\src\WireMock.Net\WireMock.Net.csproj -c %CONFIGURATION%
 
 # build WireMock.Net.Standalone
@@ -38,12 +45,16 @@ build_script:
 # build WireMock.Net.Tests (net452 and net462)
 - dotnet build .\test\WireMock.Net.Tests\WireMock.Net.Tests.csproj -c %CONFIGURATION%
 
-test_script:
-  - nuget.exe install OpenCover -ExcludeVersion
-  - nuget.exe install coveralls.net -ExcludeVersion -Version 0.7.0
-  - pip install codecov
 
-  - cmd: '"OpenCover\tools\OpenCover.Console.exe" -target:dotnet.exe -targetargs:"test test\WireMock.Net.Tests\WireMock.Net.Tests.csproj --no-build --framework net452" -output:coverage.xml -returntargetcode -register:user -filter:"+[WireMock.Net]* -[WireMock.Net.Tests*]*" -nodefaultfilters -returntargetcode -oldstyle -searchdirs:".\test\WireMock.Net.Tests\bin\%CONFIGURATION%\net452"'
-  - codecov -f "coverage.xml"
-  - coveralls.net\tools\csmacnz.Coveralls.exe --opencover -i .\coverage.xml
-  - dotnet sonarscanner end /d:sonar.login="%SONAR_TOKEN%"
+test_script:
+- nuget.exe install OpenCover -ExcludeVersion
+- nuget.exe install coveralls.net -ExcludeVersion -Version 0.7.0
+- pip install codecov
+
+- cmd: '"OpenCover\tools\OpenCover.Console.exe" -target:dotnet.exe -targetargs:"test test\WireMock.Net.Tests\WireMock.Net.Tests.csproj --no-build --framework net452" -output:coverage.xml -returntargetcode -register:user -filter:"+[WireMock.Net]* -[WireMock.Net.Tests*]*" -nodefaultfilters -returntargetcode -oldstyle -searchdirs:".\test\WireMock.Net.Tests\bin\%CONFIGURATION%\net452"'
+- codecov -f "coverage.xml"
+- coveralls.net\tools\csmacnz.Coveralls.exe --opencover -i .\coverage.xml
+
+
+# End SonarScanner
+- ps: 'if (-Not $env:APPVEYOR_PULL_REQUEST_NUMBER) { & dotnet sonarscanner end /d:sonar.login="$env:SONAR_TOKEN" }'
\ No newline at end of file