it is possible that an Azure website even after being configured to use Bitbucket for automated deployment, can still accept updated triggered manually if it previously had a git (SCM) repository exposed?
Am asking because of late, much as I hadn't pushed any commits on my Bitbucket, I noticed that there were changes to the Azure website which I hadn't created myself!
The thing that causes me trouble is that a developer who left the team a while back had access to the Azure dashboard (now access removed), and also that he possibly had access to the ftp account for the website and also its original git-deployment repo (hosted on app.scm.azurewebsites.net:443/app.git). So this last bit makes me think he could still be able to push commits directly to the branch from which azure deploys, and possibly compromise our live app!
Please help educate me on this.