Assume these are for deployment to remote services - 'use deploy keys exclusively' If the bad intent actor has access to the source code they still need to hav

Assume these are for deployment to remote services - 'use deploy keys exclusively' If the bad intent actor has access to the source code they still need to have access to push to the remote repo to issue a deployment. If they have access to the remote repo they would then have full access to the deployment, I am not certain this is avoidable if one can edit code, push, and have the pipeline deploy as desired. Car analogy? Key fob in the car in a locked garage. If you have access to the garage you can steal the car. Secure 'enough' for most people because the intrusion happened prior to the deploy.