I'm confused by one thing. I found this awesome jpg checked in on the GitLab Django demo project: http://demo.gitlabhq.com/uploads/note/attachment/2449/687474... Seems like everything else on the demo repo requires me to log in but I can access this file without authorization... Why is that? Found it in the Django demo project attachments tab: http://demo.gitlabhq.com/django/files which requires login.

It's gloriously ironic! A photo mocking Rails security attached to a private repo... that's not secure.