[ascar]

While I agree this is a good practice, it wouldn't have helped much. He had organization-level admin access and could've easily added a second dev account to accept them by himself.

[jrochkind1]

This part of the discussion started thinking about an attacker with a goal of the malicious code being undetected.