You are right that attachments are only hidden and not protected by default. GitLab uses the CarrierWave gem to store attachments and this defaults to a publicly accessible directory. You can configure the behaviour of the attachment in https://github.com/gitlabhq/gitlabhq/blob/master/app/models/...