It's always a little unexpected when the security vulnerabilities are in the tools we use to build software instead of just in the software. I suppose it's a class of supply chain vulnerability.

In this particular class of impersonation problem (the Gitlab issue is about running a pipeline as another user), sometimes I find it unnerving how much an attacker could accomplish in a software company by being able to impersonate an arbitrary Slack user. We are taught to be cautious around incoming email, but I've yet to see a security training around "how do you know that your instant messages are genuine."