A least privilege access redesign seems reasonable too. And abuse monitoring; the leak went on for 21 days undetected.