Only posting here because I've been asked about it. Gitea is protected against both of these issues.

(bias note: part of project leadership of Gitea)

Edit: As a note, security incidents happen to everyone and we shouldn't shame anyone for reporting them, especially as that'd otherwise cause less issues to be reported overall.