Hacker News Reader

I wonder how many self-hosted GitLab instances are configured with the same assumption in mind

That can hardly be blamed on GitLab though. The setting to make something public is clearly named "public", and the description is:

> The project can be accessed without any authentication.

Meanwhile, Jira almost seems to aim for misunderstanding.

There's specifying authentication and there's specifying routability. These may not be clearly distinguished to admins.

Samsung's was