yes, especially if you are using self hosted gitlab for your company, you should always put it behind corporate VPN.