To allow third party consultants, offshore developers and contractors working on the code, we can expose our Git repository externally. Or we can grant VPN access to the external parties and limit their access by configuring a new group on firewall so they can only access the Git repository in our internal network.
Which of these two options is a better security choice? Some arguments I have myself are:
1- By exposing our code repository over the Internet, we are opening door to hackers doing brute forcing on the Git. Also if there is any zero day in Git, we are impacted.
2- By providing VPN access to third parties, we allow untrusted entities into our internal network, and if the firewall rule setting is not configured well, our internal network which is more sensitive is exposed.