A proprietary rigging system can contain years of accumulated studio knowledge: naming conventions, deformation logic, automation tools, exporters, validation scripts and custom pipeline integrations.
Protecting that code in a remote studio should not depend on trusting everyone forever. A stronger system limits access according to the work being performed, records important changes and makes employee or contractor departures predictable.
It is to make sure every person can access what they need without automatically receiving permanent access to the studio’s entire technical pipeline.
Start by Deciding What Is Actually Proprietary
Not every script deserves the same level of protection.
A studio may have ordinary helper scripts alongside code that provides a genuine competitive advantage. Identify the second category explicitly.
This classification helps determine who actually needs repository access and whether every artist needs the source code at all.
Access Should Follow the Job
A remote rigger may need to run studio tools without needing administrative access to repositories, production servers and deployment credentials.
The principle of least privilege is simple: give an account only the access required for its current responsibilities.
| Role | Typical access | Usually unnecessary |
|---|---|---|
| Animator | Released rigging tools and production assets | Source repositories and deployment secrets |
| Rigger | Relevant rig modules and assigned project branches | Unrelated studio repositories |
| Pipeline developer | Required source repositories and development environment | Infrastructure administration unless the role requires it |
| Technical lead | Broader repository and review access | Permanent unrestricted access to unrelated business systems |
Do Not Put Credentials Inside Rigging Scripts
Source code and secrets should be treated as different assets.
A script may need to communicate with storage, render services or internal APIs, but passwords, API keys and service credentials should not be permanently written into the source repository.
Instead, use an appropriate secrets-management system or controlled environment configuration, and rotate credentials when exposure is suspected.
Repository copies can exist on laptops, backups, development machines and old branches long after a password has been forgotten.
Use Version Control as an Accountability Tool
Version control provides more than rollback. It can establish which account changed a file, when it changed and how the production version evolved.
For important rigging modules, consider:
- protected production branches;
- code review before merging significant changes;
- individual accounts instead of shared developer credentials;
- multi-factor authentication where the repository platform supports it;
- restricted administrative permissions;
- retained logs appropriate to the studio’s security policy.
The objective is not surveillance of developers. It is maintaining a reliable development history for software that production depends on.
Offboarding Should Happen as a Single Coordinated Event
Remote work makes incomplete offboarding especially risky because physical distance does not remove digital access.
Remote studio offboarding sequence
The last step is easy to miss. A developer may lose access to Git while an old VPN, cloud or administrative account remains available.
This is not a theoretical concern. In a published incident investigation, CISA reported that a threat actor entered an organization through a compromised account belonging to a former employee. The same incident also involved administrator accounts without MFA.
An abandoned account can later be compromised by somebody who never worked for the studio.
Protect the Code Before You Need Legal Protection
In the United States, proprietary source code may potentially qualify for trade-secret protection when the statutory requirements are met.
The federal definition specifically includes programs and codes, but it also requires the owner to take reasonable measures to keep the information secret and for the information to derive economic value from not being generally known.
That makes operational controls important. Confidentiality agreements can matter, but they should be supported by actual security practices such as limited access, authentication and controlled repositories.
Legal agreements and technical controls should support each other.
Copyright and Trade Secrets Protect Different Things
Copyright can protect original expression contained in computer code. Trade-secret law focuses on valuable information that remains secret under the applicable legal requirements.
The U.S. Copyright Office maintains a specific registration process for computer programs. Its current rules also provide deposit options for software containing trade-secret or confidential material, including certain forms of redaction.
Studios considering either form of protection should discuss the appropriate strategy with qualified counsel because ownership, employment agreements and jurisdiction can change the analysis.
If You Suspect Code Was Taken, Preserve Evidence First
Do not immediately delete every record connected to the account.
Incident checklist
- Preserve relevant repository and authentication logs.
- Record which repositories and systems the account could access.
- Revoke remaining access and exposed credentials.
- Preserve relevant employment or contractor agreements.
- Document suspicious events without altering the original records.
- Determine whether client or third-party material may also be affected.
- Obtain legal and security advice before making accusations or public statements.
A suspicious repository clone is not automatically proof of theft. Developers legitimately clone repositories during normal work, and technical evidence needs context.
Preserving records gives the studio a better chance of understanding what actually happened.
The Better System Is Built Before Anyone Leaves
Protecting proprietary rigging code should be routine rather than something a studio invents during a difficult departure.
Keep access individualized, separate source code from credentials, protect important branches, require appropriate authentication and maintain an offboarding checklist that covers every service.
A remote contributor should have exactly the access needed while working on the project—and the studio should be able to remove that access cleanly when the relationship ends.
Official references
The security, copyright and U.S. trade-secret principles in this article were checked against current government resources.
- CISA — Advisory on Compromise Through a Former Employee Account
- NIST — Identity and Access Management Guidance
- U.S. Code, Title 18 §1839 — Definition of Trade Secret
- U.S. Code, Title 18 §1836 — Civil Proceedings for Trade Secrets
- U.S. Copyright Office — Copyright Registration of Computer Programs
