I'm not reading the report as stating that everyone having access to the whole mono-repo is a security concern, but rather that the majority of people had unres

I'm not reading the report as stating that everyone having access to the whole mono-repo is a security concern, but rather that the majority of people had unrestricted access to production systems. It's one thing to be able to read all of the code, it's entirely another thing to be able to deploy arbitrary changes to production without a review.