Private Repository Management & Security
Private repository management protects the organization’s proprietary intellectual property and clinical software assets. By enforcing role-based access control (RBAC), automated secret push protection, dependency supply-chain firewalls, and private internal package registries, we prevent unauthorized leaks and safeguard the software supply chain.
Repository Access Governance & Least Privilege
In alignment with the Principle of Least Privilege (PoLP) and ISO 27001 Control A.8.4, repository permissions are provisioned strictly via centralized IdP (Okta / Google Workspace) team groups rather than individual account grants:
Read / Triage Tier
Assigned to product managers, compliance auditors, and support analysts for reviewing documentation, viewing issues, and auditing PR history.
Write / Contributor Tier
Assigned to software engineers and QA developers. Allows branch creation and PR submission, but cannot bypass branch protection or force push.
Admin / Owner Tier
Restricted to Designated DevOps Leads. Requires Multi-Factor Authentication (FIDO2 WebAuthn hardware key) and quarterly access review certification.
Secret Push Protection & Automated Scanning
- Push Protection: GitHub / GitLab Secret Push Protection is permanently enabled. Any commit containing private keys, AWS tokens, or database connection strings is rejected at the network boundary before reaching the remote repository.
- Continuous Historical Scanning: Automated weekly scans inspect git history for dormant or retired tokens.
- Zero Secret Policy: All credentials must be injected dynamically at runtime via HashiCorp Vault, AWS Secrets Manager, or Doppler.
Internal Package Registries & Scoped Namespaces
Internal shared libraries (e.g. QMS utilities, telemetry clients, design system packages) are published exclusively to private, authenticated registries using the organization scope @netspective/* to prevent public package dependency confusion attacks.
Copy this prompt to codify your repository security policies in Terraform.
Community Discussion & Feedback
Attributed peer feedback and official Netspective architecture notes.