If I had a guarantee from Gitlab that _they_ were scrubbing the data, I would have no problem. I get the sense they know what they're doing (naive, maybe)

However, giving a third party script, potentially unvetted, access to the crown jewels of the company I work for? No fucking way.

Different. Not a double standard.