See https://gitlab.com/gitlab-com/gl-security/product-security/security-architecture/general/-/issues/47