They should do both together. In banking apps, a control that slows the product or disrupts CI/CD is unlikely to survive operational pressure, even if it improves secrecy. The right sequence is to validate performance and protection in the same rollout, so security does not depend on exceptions or manual workarounds.
Why code protection and performance have to be designed together
Source code protection cannot be treated as a separate phase that happens after performance work is “done.” If controls add latency, break builds, or force manual exceptions, teams will bypass them. In practice, the safer pattern is to design secure code handling, scanning, access control, and release performance together so the control can survive production pressure.
The reason is operational, not just theoretical. Banking and other high-change environments reward controls that fit CI/CD and developer workflows, because the control that is easiest to override is usually the first one overridden. That makes the question less about sequence and more about whether security and performance are both acceptable enough to ship without special handling.
That trade-off shows up clearly in real incidents where source code, tokens, and repository access were exposed through weak controls around development tooling and code storage. NHIMG’s Internet Archive breach 2024 shows how a token exposure can turn source access into broader compromise, while Twitch breach 2021 shows how source repositories can become a secrets problem as well as an application-security problem.
What usually fails when teams separate security from performance
The common failure mode is not that teams ignore protection entirely. It is that they accept a control in a test environment, then weaken it in production because the secure path is too slow, too noisy, or too disruptive. That pattern creates exceptions, and exceptions tend to spread across branches, pipelines, and release paths until the original control no longer means much.
Code protection also has a workload cost. Secret scanning, repository protections, signed commits, approvals, and access reviews all add friction somewhere. If that friction is not measured against the actual release flow, teams often optimise the developer path and quietly leave the security path behind. The result is fast delivery with fragile secrecy, which is a poor outcome for source code, credentials, and build integrity.
This is why the best operating model is to treat performance as part of the security design criteria. A secure control that cannot complete within the release cadence is not “stronger,” it is simply less likely to be used. NHIMG’s Guide to the Secret Sprawl Challenge is a useful reminder that secrets management has to fit the way code is written, reviewed, and deployed, not just the way policy is written.
In supply-chain terms, this also affects who can move code and secrets between systems. When the control path is awkward, developers look for bypasses, and attackers look for the same gaps. That is why GitHub internal repositories breach 2026 is relevant as a pattern: token abuse and repository exposure become easier when the control plane is too permissive or too easy to reuse.
How practitioners should sequence the rollout in real projects
Do not ask whether to secure first and optimise later, or optimise first and secure later. Instead, define the acceptable latency, build time, and release overhead up front, then test the protection design against those limits. If the security design fails those limits, redesign the control rather than granting a permanent exception.
What to verify: confirm that source controls such as branch protection, secret scanning, repository access restrictions, and credential rotation still work inside the normal developer workflow. If they require a side channel, an approval shortcut, or a manual rollback step to stay usable, they are already drifting toward exception-based security.
Decision rule: if the control makes the build or release path materially worse, simplify the control before widening deployment. If the performance cost is acceptable but the control is still fragile, keep the control and fix its reliability. The goal is not maximum friction, but durable protection that teams will actually keep enabled.
Practitioner takeaway: treat source protection as part of product engineering, not a post-release gate. Controls that do not fit delivery speed, automation, and developer behaviour will usually be bypassed, which means the practical standard is “secure enough to run continuously,” not “secure enough in theory.”
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V15 — Secure Coding and Architecture | Source protection must fit the application delivery architecture and developer workflow. |
| Recommendation — Design controls so secure code handling survives normal CI/CD throughput. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | The question is about protecting source code as part of secure software delivery. |
| Recommendation — Embed code protection checks into the release pipeline before promotion. | ||
| NIST SP 800-53 Rev 5 | CM-3 — Configuration Change Control | Protecting source code and release flow depends on controlled, reviewable changes. |
| IA-5 — Authenticator Management | Source-code access often fails when tokens and credentials outlive their intended use. | |
| AC-6 — Least Privilege | Repository and build access must be limited so protection remains usable without broad exceptions. | |
| Recommendation — Enforce change control for code, pipeline and repository protections before rollout. Rotate and expire developer and automation credentials on a defined schedule. Restrict repository and pipeline access to the minimum needed for each role. | ||
Related resources from NHI Mgmt Group
- How should engineering teams use profile-guided optimization to improve application performance without changing source code?
- How should security teams protect client-side application code before deployment?
- How should security teams protect source code repositories from identity abuse?
- How should security teams discover AI usage in source code before deployment?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org