Merge requests are a place to propose changes you've made to a project and discuss those changes with others
Interested parties can even contribute by pushing commits if they want to.
On the 4th of February 2025 a known ransomware actor that goes by the name 'fog' published an archive of repositories hosted on git.hemio.de. All of the published repos are either public or open to anyone with an account on this Gitlab instance (which we regard as effectively public). For details, see https://git.hemio.de/hemio/databreach_2025-02-04/-/blob/main/readme.md?ref_type=heads
No private repositories or other user data was contained in the publication.
Interested parties can even contribute by pushing commits if they want to.