Change Bitbucket login from username / password to login with Google

It remembers your code for 30 days, but if your phone gets stolen, you just remove the "mobile application" (this means Google Authenticator) associated with your phone from the two-step settings page. This will immediately invalidate your code, and your phone browser will no longer log in*.

This is what the setting looks like in my account:

This does mean that you need to remember to remove at least two things should your phone get stolen: Your Google Authenticator application, and the application-specific password for your phone. You might also have other application-specific passwords to remove.

This also applies to any other device containing a logged in browser (like a laptop). The code will remain valid for 30 days unless you remove the Google Authenticator application in the settings. If it wasn't your phone that was stolen, you can immediately register the Google Authenticator application again and you will get new code to use.

*This is my understanding of how it works but so far as I can see this is not spelled out in Google's documentation anywhere.

Not the way you're thinking of at least in GitHub.

What you could try is have two separate repos with their own access list using Organizations and Teams.

When you create teams in GitHub you can also restrict access to certain repositories per team.

So you can set up the following:

• dev-repo - Only add and allow access to developers
• audit-repo - Only add and allow access to code auditors

Then, when dev-repo has new commits, pull down the changes to your local and push them back up to audit-repo.

Auditors can then leave comments and issues on their version of the repository under audit-repo and you can then relay any issues you think dev-repo should know about without either developer or auditor team seeing each other via these private repos.