Hacker News Reader

When you own it you can just limit it into vpn-ed company users, that significantly cuts down on the area that can be hit

I mean, the GitHub Actions supply chain risks and attacks definitely compensate for any GitLab security vulnerabilities you can think of.

Hide it behind VPN, so it's not accessible from outside.

Now patching becomes a responsibility, unless your organisation is willing to run knowingly vulnerable software.