[stephenr]

We use a cloudflare firewall, and then have a facility for users (i.e. "staff") to add themselves to the whitelist, via a tooling page for each env (which isn't behind the firewall, but does rely on http basic auth).

It's not perfect, but I think it works better than what it replaced (logic in the application and a shared 'secret' to access those environments)