Use a dedicated machine for pipelines, isolate the runners, use '-ephemeral', disable user registration, restrict inbound to the gitea IP Make sure you use latest software as there were some big vuln...