Post Mortem:
The server I run Flotilla, zooid, and other things on got hacked this morning at about 5 AM Pacific. I had disabled the gitea action runner for pull requests, but not for users' own repo...
I am setting up auto-vuln scanning, maybe useful to prevent such cases and get notified about such issues with gitea e.g.. But also defense in depth helps too.
1