Monorepo are usually better for security. - you can update dependencies of multiple components/modules in one commit/pr. In general, it would be easier to ke

Monorepo are usually better for security. - you can update dependencies of multiple components/modules in one commit/pr. In general, it would be easier to keep up with third party dependencies. - it is harder to monitor and audit multiple repositories than a single monorepo. An attacker can inject a malicious commit in one of the less active repositories and nobody will notice. In most cases, leakage is the same. If one developer PC get compromised, and you do not use 2FA, the attacker can still get access to most of the code. In many cases, data is a more interesting target than your source code. From security perspective in order: 1. Educate your developers on security. 2. Develop threat model 3. Monitor for anomalies 4. Use 2FA auth 5. Secure your CI/CD 6. Keep dependencies up to date 7. Security scanning