I applaud the decision to get rid of Jenkins. The way Jenkins works, with each plugin being able to implement arbitrary endpoint, it is almost inevitable that

I applaud the decision to get rid of Jenkins. The way Jenkins works, with each plugin being able to implement arbitrary endpoint, it is almost inevitable that it would have many security vulnerabilities. No Jenkins masters should be exposed to the internet, ever -- and if there is really no other way, then set up a proxy in front of it with strict whitelist of allowed URLs.