PSA: If you use GOGS.io (the predecessor to Gitea and friends), please make sure self-registration is disabled. I reported a trivial RCE a couple months ago, received no reply, and it's starting to look intentional.