I don't hire, but work for a 100% remote company. All of our code is open source, so I don't have any more access to take it than random person on the Internet.

I don't hire, but work for a 100% remote company. All of our code is open source, so I don't have any more access to take it than random person on the Internet. Don't make secrecy the key to your company's value. For what it's worth, though, clearly a company needs some secrets even if the code isn't. I've only worked on government contracts and they handle this in a pretty simple way. You're required to use a CaC to access anything. That means you need to be a US person and go in person to an ID card office to have your identity and location verified. While your company doesn't have the means to set up remote offices all over the country to verify identities and issue smart cards to your employees, you can at least have them go to IdentiGO or something to get fingerprinted, which has the same effect of verifying they're in a locality where you can sue them and they won't easily disappear if they steal something from you. Remote workforce doesn't mean all of your employees are digital nomads. They can have a nice, stable, law-abiding existence in a US city that just happens to not be the same one you're in, and that is easy enough to verify.