> Just get the source code of Forgejo, audit it thoroughly and run an instance of that.

Or use the open-source version that is used by a lot of big companies and enterprises and has the enterprise features they actually need. Some of these will also have their own security team and would be flagging security issues to Gitlab in a hopefully responsible way.

There's no such thing as "just get the source and make sure there's no security issues". If it would be that easy don't you think Forgejo would've already done that?