Self hosted GitLab has been good to me forever and has scaled and has a controllable attack surface as long as you keep on top of it

Newer app is moving to Google Cloud Secure Source Manager (because we are on Google Cloud and using backbone auth so it made more sense and less involved to manage)