I can't comment on either project's security scrutiny, as I'm not intimately familiar with either of their security teams. I will say that, as a rule, I don't

I can't comment on either project's security scrutiny, as I'm not intimately familiar with either of their security teams. I will say that, as a rule, I don't believe I can ever trust Github, regardless of how good their team is. I treat every packet I send as "completely public" and every packet I receive as "possibly malicious", just like every other website on the Internet. GitLab: it's at least possible for me to trust (i.e. if I self-host it). (But I really do need to pick up Ruby sometime soon.)