Couldn't agree more, and came here to say this also. I understand that they are driving forward with new features for developers, but security cannot be taken seriously enough when they are hosting organisation's private code. I cannot take them seriously until they add this feature.