Password-locked editors for the sensitive repo

A small team works on the auth service. The repo doesn't go on laptops. It doesn't get cloned to coffee-shop disk. It doesn't sync to a third-party Codespaces VM.

You spawn one editor instance per engineer, each keyed to a SHA-256 password hash they hold. The URL is public; the password is theirs. Without the hash, the URL is a login page. With it, VS Code opens on the engineer's instance, on a container running on the bare metal box your company owns.

Code reviews happen in the same container: different instance ID, same disk, same lockdown. When an engineer leaves the team, you delete their instance ID and their data directory. There's no laptop to wipe.