No matter if you host your own copy of GitLab Software or use GitLab's servers directly, you should enable 2-step Verification - NOW (right now, do not wait). There is a current exploit that allows someone to hijack GitLab Accounts, who are not using 2-step verification.
