diff --git a/charts/kubechecks/Chart.yaml b/charts/kubechecks/Chart.yaml
index cd791d3a..ea21292b 100644
--- a/charts/kubechecks/Chart.yaml
+++ b/charts/kubechecks/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
 name: kubechecks
 description: A Helm chart for kubechecks
-version: 0.4.0
-appVersion: "1.1.1"
+version: 0.4.1
+appVersion: "1.3.3"
 type: application
 maintainers:
   - name: zapier
diff --git a/charts/kubechecks/templates/_helpers.tpl b/charts/kubechecks/templates/_helpers.tpl
index 8367585c..98422308 100644
--- a/charts/kubechecks/templates/_helpers.tpl
+++ b/charts/kubechecks/templates/_helpers.tpl
@@ -37,7 +37,7 @@ Common labels
 helm.sh/chart: {{ include "kubechecks.chart" . }}
 {{ include "kubechecks.selectorLabels" . }}
 {{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ coalesce .Values.deployment.image.tag .Chart.AppVersion | quote }}
 {{- end }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- if .Values.commonLabels }}
diff --git a/charts/kubechecks/tests/deployment_test.yaml b/charts/kubechecks/tests/deployment_test.yaml
index 387b758b..7585558b 100644
--- a/charts/kubechecks/tests/deployment_test.yaml
+++ b/charts/kubechecks/tests/deployment_test.yaml
@@ -168,3 +168,27 @@ tests:
                 name: new-configmap
             - secretMap:
                 name: new-secret
+  - it: should render tag as annotation
+    chart:
+      appVersion: 1.0.0
+      version: 0.1.0
+    release:
+      name: kubechecks
+    set:
+      deployment:
+        image:
+          tag: 2.0.0
+    asserts:
+      - isKind:
+          of: Deployment
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: ghcr.io/zapier/kubechecks:2.0.0
+      - equal:
+          path: metadata.labels
+          value:
+            app.kubernetes.io/instance: kubechecks
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kubechecks
+            app.kubernetes.io/version: 2.0.0
+            helm.sh/chart: kubechecks-0.1.0
diff --git a/pkg/config/walk_kustomize_files.go b/pkg/config/walk_kustomize_files.go
index c68a6894..51b476e1 100644
--- a/pkg/config/walk_kustomize_files.go
+++ b/pkg/config/walk_kustomize_files.go
@@ -5,6 +5,7 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/pkg/errors"
 	"github.com/rs/zerolog/log"
@@ -48,6 +49,11 @@ func walkKustomizeFiles(result *AppDirectory, fs fs.FS, appName, dirpath string)
 	}
 
 	for _, resource := range kustomize.Resources {
+		if strings.Contains(resource, "://") {
+			// no reason to walk remote files, since they can't be changed
+			continue
+		}
+
 		var relPath string
 		if len(resource) >= 1 && resource[0] == '/' {
 			relPath = resource[1:]
@@ -57,8 +63,7 @@ func walkKustomizeFiles(result *AppDirectory, fs fs.FS, appName, dirpath string)
 
 		file, err := fs.Open(relPath)
 		if err != nil {
-			log.Warn().Err(err).Msgf("failed to read %s", relPath)
-			continue
+			return errors.Wrapf(err, "failed to read %s", relPath)
 		}
 		stat, err := file.Stat()
 		if err != nil {
diff --git a/pkg/config/walk_kustomize_files_test.go b/pkg/config/walk_kustomize_files_test.go
index 3834fc50..8c5bb8bb 100644
--- a/pkg/config/walk_kustomize_files_test.go
+++ b/pkg/config/walk_kustomize_files_test.go
@@ -40,6 +40,7 @@ resources:
 - ../overlays/base
 - ./overlays/dev
 - /common/overlays/prod
+- https://google.com/some/url
 `)},
 
 			"test/app2/kustomization.yaml": {
diff --git a/pkg/local/gitRepos.go b/pkg/local/gitRepos.go
index 4036c83f..b8603bb8 100644
--- a/pkg/local/gitRepos.go
+++ b/pkg/local/gitRepos.go
@@ -69,6 +69,8 @@ func (rd *ReposDirectory) Register(ctx context.Context, cloneUrl string) string
 
 func (rd *ReposDirectory) fetchLatest() {
 	cmd := exec.Command("git", "pull")
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stdout
 	err := cmd.Run()
 	if err != nil {
 		log.Err(err).Msg("failed to pull latest")
diff --git a/pkg/message.go b/pkg/message.go
index 08b28f94..c2b1d0ca 100644
--- a/pkg/message.go
+++ b/pkg/message.go
@@ -146,7 +146,7 @@ func buildComment(ctx context.Context, apps map[string]*AppResults) string {
 		sb.WriteString("<summary>\n\n")
 		sb.WriteString(fmt.Sprintf("## ArgoCD Application Checks: `%s` %s\n", appName, appState.Emoji()))
 		sb.WriteString("</summary>\n\n")
-		sb.WriteString(strings.Join(checkStrings, "---\n"))
+		sb.WriteString(strings.Join(checkStrings, "\n\n---\n\n"))
 		sb.WriteString("</details>")
 	}
 
diff --git a/pkg/message_test.go b/pkg/message_test.go
index af7d2de5..3d6fa9eb 100644
--- a/pkg/message_test.go
+++ b/pkg/message_test.go
@@ -2,6 +2,7 @@ package pkg
 
 import (
 	"context"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -92,3 +93,61 @@ func TestMessageIsSuccess(t *testing.T) {
 		})
 	}
 }
+
+func TestMultipleItemsWithNewlines(t *testing.T) {
+	var (
+		message = NewMessage("name", 1, 2)
+		ctx     = context.Background()
+	)
+	message.AddNewApp(ctx, "first-app")
+	message.AddToAppMessage(ctx, "first-app", CheckResult{
+		State:   StateSuccess,
+		Summary: "summary-1",
+		Details: "detail-1",
+	})
+	message.AddToAppMessage(ctx, "first-app", CheckResult{
+		State:   StateSuccess,
+		Summary: "summary-2",
+		Details: "detail-2",
+	})
+	message.AddNewApp(ctx, "second-app")
+	message.AddToAppMessage(ctx, "second-app", CheckResult{
+		State:   StateSuccess,
+		Summary: "summary-1",
+		Details: "detail-1",
+	})
+	message.AddToAppMessage(ctx, "second-app", CheckResult{
+		State:   StateSuccess,
+		Summary: "summary-2",
+		Details: "detail-2",
+	})
+	result := message.BuildComment(ctx)
+
+	// header rows need double newlines before and after
+	index := 0
+	newline := uint8('\n')
+	for {
+		index++
+		foundAt := strings.Index(result[index:], "---")
+		if foundAt == -1 {
+			break // couldn't be found, we're done
+		}
+		index += foundAt
+
+		if index < 2 {
+			continue // hyphens are at the beginning of the string, we're fine
+		}
+
+		if result[index-1] == '-' || result[index+3] == '-' {
+			continue // not a triple-hyphen, but a more-than-triple-hyphen, move on
+		}
+
+		// must be preceded by two newlines
+		assert.Equal(t, newline, result[index-1])
+		assert.Equal(t, newline, result[index-2])
+
+		// must be followed by two newlines
+		assert.Equal(t, newline, result[index+3])
+		assert.Equal(t, newline, result[index+4])
+	}
+}
diff --git a/pkg/repo/repo.go b/pkg/repo/repo.go
index e431eb85..befee731 100644
--- a/pkg/repo/repo.go
+++ b/pkg/repo/repo.go
@@ -211,8 +211,20 @@ func (r *Repo) execCommand(name string, args ...string) *exec.Cmd {
 	return cmd
 }
 
+func censorVcsToken(v *viper.Viper, args []string) []string {
+	vcsToken := v.GetString("vcs-token")
+
+	var argsToLog []string
+	for _, arg := range args {
+		argsToLog = append(argsToLog, strings.Replace(arg, vcsToken, "********", 10))
+	}
+	return argsToLog
+}
+
 func execCommand(name string, args ...string) *exec.Cmd {
-	log.Debug().Strs("args", args).Msg("building command")
+	argsToLog := censorVcsToken(viper.GetViper(), args)
+
+	log.Debug().Strs("args", argsToLog).Msg("building command")
 	cmd := exec.Command(name, args...)
 	return cmd
 }
diff --git a/pkg/repo/repo_test.go b/pkg/repo/repo_test.go
index 078bfdb1..88aa1cb9 100644
--- a/pkg/repo/repo_test.go
+++ b/pkg/repo/repo_test.go
@@ -67,3 +67,10 @@ func TestGetCloneUrl(t *testing.T) {
 		})
 	}
 }
+
+func TestCensorVcsToken(t *testing.T) {
+	v := viper.New()
+	v.Set("vcs-token", "hre")
+	result := censorVcsToken(v, []string{"one", "two", "three"})
+	assert.Equal(t, []string{"one", "two", "t********e"}, result)
+}
diff --git a/pkg/vcs/client.go b/pkg/vcs/client.go
index b5881fa1..1aeec323 100644
--- a/pkg/vcs/client.go
+++ b/pkg/vcs/client.go
@@ -9,6 +9,11 @@ import (
 	"github.com/zapier/kubechecks/pkg/repo"
 )
 
+const (
+	DefaultVcsUsername = "kubechecks"
+	DefaultVcsEmail    = "kubechecks@zapier.com"
+)
+
 var (
 	// ErrInvalidType is a sentinel error for use in client implementations
 	ErrInvalidType  = errors.New("invalid event type")
diff --git a/pkg/vcs/github_client/client.go b/pkg/vcs/github_client/client.go
index 09b14f99..f7c9ebef 100644
--- a/pkg/vcs/github_client/client.go
+++ b/pkg/vcs/github_client/client.go
@@ -69,12 +69,26 @@ func CreateGithubClient() (*Client, error) {
 		return nil, errors.Wrap(err, "failed to get user")
 	}
 
-	return &Client{
+	client := &Client{
 		Client:   googleClient,
 		v4Client: shurcoolClient,
-		username: *user.Login,
-		email:    *user.Email,
-	}, nil
+	}
+	if user != nil {
+		if user.Login != nil {
+			client.username = *user.Login
+		}
+		if user.Email != nil {
+			client.email = *user.Email
+		}
+	}
+
+	if client.username == "" {
+		client.username = vcs.DefaultVcsUsername
+	}
+	if client.email == "" {
+		client.email = vcs.DefaultVcsEmail
+	}
+	return client, nil
 }
 
 func (c *Client) Username() string { return c.username }
diff --git a/pkg/vcs/gitlab_client/client.go b/pkg/vcs/gitlab_client/client.go
index e32b2b50..ab4099e9 100644
--- a/pkg/vcs/gitlab_client/client.go
+++ b/pkg/vcs/gitlab_client/client.go
@@ -55,7 +55,14 @@ func CreateGitlabClient() (*Client, error) {
 		return nil, errors.Wrap(err, "failed to get current user")
 	}
 
-	return &Client{Client: c, username: user.Username, email: user.Email}, nil
+	client := &Client{Client: c, username: user.Username, email: user.Email}
+	if client.username == "" {
+		client.username = vcs.DefaultVcsUsername
+	}
+	if client.email == "" {
+		client.email = vcs.DefaultVcsEmail
+	}
+	return client, nil
 }
 
 func (c *Client) Email() string    { return c.email }