diff --git a/.travis.yml b/.travis.yml
index 54732ce..f48c3c2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -10,78 +10,84 @@
 #
 # DOCKER_USERNAME       If PUBLISH_IMAGES is 'yes'
 # DOCKER_PASSWORD       If PUBLISH_IMAGES is 'yes'
+#
+# -----------------
+#
+# NOTE: Pull requests from foreign repositories will not
+#       result in encrupted variables being set.
+#       So, regardless of the state of PUBLISH_IMAGES,
+#       images will only be published if DOCKER_PASSWORD is defined.
 
 os: linux
 services:
 - docker
 
 stages:
+- name: test
 - name: publish latest
   if: |
     branch = master \
-    AND env(PUBLISH_IMAGES) = yes
-- name: test latest
-  if: |
-    branch = master \
-    AND env(PUBLISH_IMAGES) = yes
+    AND env(PUBLISH_IMAGES) = yes \
+    AND env(DOCKER_PASSWORD) IS present
 - name: publish tag
   if: |
     tag IS present \
-    AND env(PUBLISH_IMAGES) = yes
+    AND env(PUBLISH_IMAGES) = yes \
+    AND env(DOCKER_PASSWORD) IS present
 - name: publish stable
   if: |
     tag IS present \
     AND tag =~ ^([0-9]+\.){1,2}[0-9]+$ \
-    AND env(PUBLISH_IMAGES) = yes
-
-before_script:
-- docker login -u="$DOCKER_USERNAME" -p="$DOCKER_PASSWORD"
+    AND env(PUBLISH_IMAGES) = yes \
+    AND env(DOCKER_PASSWORD) IS present
 
 jobs:
   include:
 
+  - stage: test
+    name: Test Local Image
+    script:
+    - docker build -t informaticsmatters/rdkit_pipelines:latest -f Dockerfile-rdkit .
+    - docker build -t squonk/rdkit-pipelines-sdposter:latest -f Dockerfile-sdposter .
+    - git clone https://github.com/InformaticsMatters/pipelines-utils.git
+    - cd pipelines-utils/src/groovy
+    - groovy PipelineTester.groovy -indocker
+
   # Publish-stage jobs...
-  # Every successful master build results in a latest image (above)
+  # Every successful master build results in a latest image
   # and every tag results in a tagged image in Docker Hub.
   # Tags that match a RegEx are considered 'official' tags
   # and also result in a 'stable' image tag.
 
   - stage: publish latest
-    name: Latest Image
+    name: Publish Latest Image
     script:
     # Build and push the pipelines-rdkit image and its sd-poster
     - docker build -t informaticsmatters/rdkit_pipelines:latest -f Dockerfile-rdkit .
-    - docker push informaticsmatters/rdkit_pipelines:latest
     - docker build -t squonk/rdkit-pipelines-sdposter:latest -f Dockerfile-sdposter .
+    - docker login -u="$DOCKER_USERNAME" -p="$DOCKER_PASSWORD"
+    - docker push informaticsmatters/rdkit_pipelines:latest
     - docker push squonk/rdkit-pipelines-sdposter:latest
 
-  - stage: test latest
-    name: Test Latest Image
-    script:
-    # Pull the latest pipelines-rdkit image
-    # then clone the utils rep (containing the test engine)
-    # and then run the tests
-    - docker pull informaticsmatters/rdkit_pipelines:latest
-    - git clone https://github.com/InformaticsMatters/pipelines-utils.git
-    - cd pipelines-utils/src/groovy
-    - groovy PipelineTester.groovy -indocker
-
   - stage: publish tag
-    name: Tagged Image
+    name: Publish Tagged Image
     script:
     # Build and push the pipelines-rdkit image and its sd-poster
     - docker build -t informaticsmatters/rdkit_pipelines:${TRAVIS_TAG} -f Dockerfile-rdkit .
-    - docker push informaticsmatters/rdkit_pipelines:${TRAVIS_TAG}
     - docker build -t squonk/rdkit-pipelines-sdposter:${TRAVIS_TAG} -f Dockerfile-sdposter .
+    - docker login -u="$DOCKER_USERNAME" -p="$DOCKER_PASSWORD"
+    - docker push informaticsmatters/rdkit_pipelines:${TRAVIS_TAG}
     - docker push squonk/rdkit-pipelines-sdposter:${TRAVIS_TAG}
 
   - stage: publish stable
-    name: Stable Image
+    name: Publish Stable Image
     script:
-    # Pull the corresponding pipelines-rdkit image tag and push it as 'stable'
+    # Pull the corresponding pipelines-rdkit image tag
+    # and push it again as 'stable'
+    - docker login -u="$DOCKER_USERNAME" -p="$DOCKER_PASSWORD"
     - docker pull informaticsmatters/rdkit_pipelines:${TRAVIS_TAG}
-    - docker tag informaticsmatters/rdkit_pipelines:${TRAVIS_TAG} informaticsmatters/rdkit_pipelines:stable
-    - docker push informaticsmatters/rdkit_pipelines:stable
     - docker pull squonk/rdkit-pipelines-sdposter:${TRAVIS_TAG}
+    - docker tag informaticsmatters/rdkit_pipelines:${TRAVIS_TAG} informaticsmatters/rdkit_pipelines:stable
     - docker tag squonk/rdkit-pipelines-sdposter:${TRAVIS_TAG} squonk/rdkit-pipelines-sdposter:stable
+    - docker push informaticsmatters/rdkit_pipelines:stable
     - docker push squonk/rdkit-pipelines-sdposter:stable
diff --git a/src/python/pipelines/xchem/xcos.py b/src/python/pipelines/xchem/xcos.py
index 590a70e..c19bad6 100644
--- a/src/python/pipelines/xchem/xcos.py
+++ b/src/python/pipelines/xchem/xcos.py
@@ -119,6 +119,13 @@ def getReverseScores(mols, frags, COS_threshold, writer):
 
             for frag_mol in frags:
 
+                # NB reverse SuCOS scoring
+                fm_score = getFeatureMapScore(bit, frag_mol)
+                fm_score = np.clip(fm_score, 0, 1)
+                # Change van der Waals radius scale for stricter overlay
+                protrude_dist = rdShapeHelpers.ShapeProtrudeDist(bit, frag_mol, allowReordering=False, vdwScale=0.2)
+                protrude_dist = np.clip(protrude_dist, 0, 1)
+
                 # Get frag name for linking to score
                 frag_name = frag_mol.GetProp('_Name').strip('Mpro-')