Hacker News Reader

We apologize that you haven't received an email notification. We've sent email notifications to as many customers as possible, but obviously did not get everyone.

Rest assured that when domain verification rolls out, there will be an email notification you'll receive regarding a grace period to address your required user actions prior to re-verification.

If you have any further questions about this plan, feel free to contact us directly at security@gitlab.com

It seems that a notice would only need to be sent to users that used to have an active GitLab pages setup with a custom domain that does not any more. No point in alerting customers that are not affected yet in my mind. If you do have a currently active setup, not action is needed until a fix is issue, and then it would be necessary to alert people.

I've brought this up with the team working on this to get a better understanding of our notification approach for this issue.