Forgejo did and will in the future, same as GitLab.

The only difference is the architecture/moving parts/featureset which roughly corresponds to the attack surface, which then roughly corresponds to how many CVEs will be found, though that's also affected by how big a given target is.

For example, total new CVEs:

          2024 2025 2026
  Forgejo    1   10  >55 (confirmed ones, checked what I could)
  Gitea      1    9  121
  GitLab   145  165  251

(a lot of the reporting out there sucks, cause some CVEs get assigned to Gitea and may or may not be applicable to Forgejo as well, so you have to dig into the details for example https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSear... and https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSear... and https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSear... )

That's not to say that Forgejo is some perfect piece of software, just that it builds on some of the past experience of Gitea and just has both less features than GitLab, is simpler, and also a smaller target. It will probably get >100 per year too soon, but I'd reckon that the totals will remain than GitLab for the foreseeable future.

Maybe I'm wrong!