Pages domain show view is not protected by access control
The route gl-namespace/pages/domain/:domainname
is not protected by access control, if the project is public it can be browsed by anyone, if the project is private, read access to the project is enough.
A real example: https://gitlab.com/nolith-tests/test-pages/pages/domains/test.fuf.me
I'm not sure if it's enough to add a security label, we show only the public certificate which is already available if you know the domain name.
/cc @nick.thomas
Edited by Alessio Caiazza