I like GitLab, I like the UI, and their product. But a lot of companies treat GitLab like its their own personal GitHub and just shove it onto an internet accessible instance, and the only thing standing between their internal IP being stolen and safe is developer account passwords and GitLab&#x27;s code quality.<p>This is why when I set up GitLab CE we set it up behind a VPN. Now an attacker needs to compromise both the VPN and GitLab itself to get away with any internal IP. It isn&#x27;t unbeatable, but if you want developers to be able to work remotely it is the least you should do.