A SaaS provider hosts its source code in a self-managed git platform. After a contractor's stolen laptop was used to clone several private repositories, the security committee asked for a programme of controls focused on the code repository itself. As the security lead, which control should you implement FIRST?
- AEnable repository-wide secret scanning with automatic credential revocation so any leaked tokens inside the cloned code are rendered useless within minutes.
- BMove all private repositories behind a virtual private network so cloning is only possible when the engineer is connected to the corporate network.
- CEncrypt all repositories at rest with a customer-managed key so a stolen clone would be unreadable outside the corporate environment.
- DRequire phishing-resistant multi-factor authentication and short-lived hardware-bound credentials for every account that can access the source code platform. Correct
Why A is wrong: Secret scanning reduces the impact of secrets already inside the repositories but does not address the underlying access control failure that allowed an unauthorised clone in the first place.
Why B is wrong: VPN gating is a coarse network control that conflicts with modern remote development, is bypassed by any attacker who has the same VPN credentials, and treats network location as a proxy for trust.
Why C is wrong: Encryption at rest protects against disk theft from the hosting platform, not against an authenticated clone; once a legitimate session pulls the code, the working tree is decrypted and the control adds no protection here.
Why D is correct: The root cause was an attacker reusing a contractor's credentials from a stolen device; phishing-resistant MFA and hardware-bound short-lived credentials directly prevent that reuse and protect every repository in the platform.