Protect source and CI
Protect repository access
Require strong authentication, least privilege, attributable accounts, prompt offboarding, and recovery controls for source hosting.
8 minute lesson
Source hosting controls what becomes trusted code. Protect it as a production system.
Require MFA or passkeys, avoid shared accounts, limit organization owners, and review collaborators and deploy keys. Keep emergency recovery controlled and tested. Remove access immediately when a person or integration no longer needs it.
A contractor leaves, but their personal account and old deploy key remain attached to the repository. Months later, either credential can still change release source without using a current team identity.
Recovery access is another privileged path. Strong daily authentication helps little if one shared recovery account can bypass it.
Export or capture the current owners, collaborators, applications, deploy keys, and recovery methods for one repository. Assign an owner and reason to every privileged entry, then remove one disposable test identity and prove its access fails. Record how the team would recover if the last owner lost access.
Lesson completed