[TAForObvReasons]

> using a custom version of popular code repository Gitlab, located at the web address gitlab.aggregateiq.com. Entering the URL, Gitlab prompts the user to register to see the contents - a free process which simply requires supplying an email address. Once registered, contents of the dozens of separate code repositories operated on the AggregateIQ Gitlab subdomain are entirely downloadable.

Is this (anyone can register with an email address) the default mode for a self-hosted gitlab deployment?

[JetSpiegel]

You can always blacklist or whitelist certain email domains.

You will want to make all your repositories private, which makes you whitelist all access.