Absolute prevention is probably impossible, but you can severely reduce the chances of successful attack by a) limiting access to security critical parts of cod

Absolute prevention is probably impossible, but you can severely reduce the chances of successful attack by a) limiting access to security critical parts of code b) having shadow reviews of the same code (e.g. a separate team, that gets a notification every time these pieces of code are modified, and re-reviews them without notifying the original patch submitter)