diff --git a/bin/joj3-forge-convert b/bin/joj3-forge-convert
index 7a30381..882c47c 100755
--- a/bin/joj3-forge-convert
+++ b/bin/joj3-forge-convert
@@ -18,7 +18,7 @@ main() {
     repo_name=$(basename "$(pwd)")
     course=${repo_name%-*}
     if ! [[ "$course" =~ ^[a-zA-Z0-9_-]+$ ]]; then
-        echo "FATAL: Invalid course name: $course"
+        echo "FATAL: Invalid course name: $course" >&2
         exit 1
     fi
 
@@ -51,6 +51,10 @@ EOF
 
     git -C "$config_repo_path" reset --hard
     git -C "$config_repo_path" pull --rebase
+    if [ -e "$config_repo_path/home/tt/.config/teapot/teapot.env" ]; then
+        echo "FATAL: Forbidden file found in '/home/tt/.config/teapot/teapot.env'. Check the latest README to set TEAPOT_GITEA_TOKEN in secrets instead." >&2
+        exit 1
+    fi
     rsync -a "$config_repo_path/home/tt/.ssh/" "/home/tt/.ssh"
     rsync -a --delete "$config_repo_path/home/tt/.config/" "/home/tt/.config"
     joj3-forge convert "/home/tt/.config/joj"
@@ -69,7 +73,7 @@ GITEA_ORG_NAME=$org_name
 GITEA_ACCESS_TOKEN=$TEAPOT_GITEA_TOKEN
 EOF
     else
-        echo "FATAL: TEAPOT_GITEA_TOKEN not set"
+        echo "FATAL: TEAPOT_GITEA_TOKEN not set" >&2
         exit 1
     fi
 }