Notifications
Clear all
Topic starter
15/08/2026 6:07 pm
TL;DR: Source code is now the blueprint for infrastructure, and a repository compromise can expose secrets, trust relationships, and deployment paths that let attackers alter production without touching a server, according to ClearVector. The shift makes developer identity, source control, and CI/CD governance inseparable from infrastructure security.
NHIMG editorial — based on content published by ClearVector: The blueprint betrayal: why source code is your new infrastructure
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: How should security teams govern developer identities in the SDLC?
A: Security teams should treat developer identities as privileged non-human and human access paths inside the delivery pipeline.
Q: Why do source repositories create outsized identity risk in IaC environments?
A: Because repository content can define infrastructure, policy, and deployment behaviour.
Q: What breaks when secrets are left inside generated code?
A: Hardcoded secrets turn code into a credential repository, which expands exposure through source control, logs, build systems, and copied templates.
Practitioner guidance
- Classify repository access as infrastructure authority Map which source control accounts, tokens, and service identities can change production-relevant code, build artifacts, or signing inputs.
- Scan and revoke embedded secrets continuously Run secret discovery across active branches, tags, forks, and build logs, then rotate or revoke any credential exposed in code, comments, environment files, or pipeline variables before it can be reused.
- Correlate developer actions across the delivery chain Tie repository commits, pull requests, pipeline triggers, signing events, and deployment actions back to the originating identity so suspicious activity can be isolated before trusted release.
What's in the full article
ClearVector's full blog covers the operational detail this post intentionally leaves for the source:
- The Microsoft Midnight Blizzard and F5 source-code theft references in more detail, including the specific attacker behaviour described by ClearVector.
- The repository and CI/CD trust-chain examples that show how code changes can inherit production credibility.
- ClearVector's argument for treating source code as infrastructure across developer identity, secrets, and release governance.
- The source article's full discussion of AI as an accelerant for code analysis and malicious modification.
👉 Read ClearVector's analysis of why source code now acts as infrastructure →
Source code as infrastructure: what does this change for IAM teams?
Explore further
15/08/2026 6:15 pm
Source code has become an identity-governed control surface, not just developer output. When code defines infrastructure, the repository becomes a place where access decisions turn into operational change. That collapses the old boundary between development and production, and it means identity governance must extend into source control, build, and signing workflows. Practitioners should treat repository authority as infrastructure authority.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
A question worth separating out:
Q: How do security teams reduce supply chain impact from compromised code access?
A: They should enforce identity attribution across repository, CI/CD, and signing systems so suspicious changes can be isolated before release completion. The goal is to break the chain between commit, build, and trust inheritance. That requires monitoring, separation of duties, and rapid revocation of the compromised identity.
👉 Read our full editorial: Source code now functions as infrastructure, not just intellectual property
