You can but most don't, even Twitter size, that's the lesson. And audit doesn't protect from leakage. Please note, I'm not saying Gitlab response was appropria

You can but most don't, even Twitter size, that's the lesson. And audit doesn't protect from leakage. Please note, I'm not saying Gitlab response was appropriate, I totally agree with your second point. I'm saying the demand was genuine.