[hsbauauvhabzb]

Sounds good until you see their cvedetails page

[PunchyHamster]

When you own it you can just limit it into vpn-ed company users, that significantly cuts down on the area that can be hit

[sofixa]

I mean, the GitHub Actions supply chain risks and attacks definitely compensate for any GitLab security vulnerabilities you can think of.

[lazystone]

Hide it behind VPN, so it's not accessible from outside.

[hsbauauvhabzb]

Now patching becomes a responsibility, unless your organisation is willing to run knowingly vulnerable software.