Users (here customers together with us in jira cloud), with are not in development permission (can't see dev panel on work item), are able to browse the app in app menu. By using this option, they are able to access commits with code and messages.

Please create to restrict this further access inside the app, using a user group (black or whitelist).

We have more than 1000 repositories with around 700+ users.