Sounds like 2FA should be required for CI.