> requiring peer reviews I didn’t say anything about peer reviews. Regarding the rest of your comment: - if you are committing to a branch directly that then

> requiring peer reviews I didn’t say anything about peer reviews. Regarding the rest of your comment: - if you are committing to a branch directly that then immediately goes to production you are doing something horribly wrong - having a formal process for code reviews is like making sure there is a formal process to make sure employees wear pants to work. If this sort of thing has to be policed by security settings in the dev environment, then something deeper is wrong. I mostly work on safety critical code, so I know what it means to ship a mission critical code base. Most of the things you allude to suggest that you’ve never worked with a competent release manager or qa organization. Edit: also: > There’s always a balance between security/quality control and productivity This is only true for definitions of “productivity” that exclude security/quality control, which usually mean that things are so out of whack, it is time to find a new job. By definition, the “productive” people aren’t worrying about product quality, and are being promoted for it, so soon the organization will be run by people that sabotaged the business.