If the dev team needs something like ngrok, the security team has failed to provide proper tools.
If the dev team goes ahead and uses ngrok without consulting the security team, the dev team has likely committed an awful security breach.
The dev team and the security team need to think of each other as being on the same team, and talk to each every day about what they want and need.
just don't use your company's name in the domain name, make it something obscure.
If the dev team needs something like ngrok, the security team has failed to provide proper tools.
If the dev team goes ahead and uses ngrok without consulting the security team, the dev team has likely committed an awful security breach.
The dev team and the security team need to think of each other as being on the same team, and talk to each every day about what they want and need.