Bold of you to assume I haven’t read and understood the contents of my contract which implicitly does not disallow this.

Realistically I build spikes and prototypes on my own hardware and only push to the environment never pull. Production code, credentials and data never goes near personal equipment.