world-readable for httpd
world-readable for httpd is not always set by vufind-php
The old "Limit access from this project" setting (previously called "Limit CI_JOB_TOKEN access") was completely removed. For projects created before GitLab 15.9, the allowlist was disabled by default, allowing job token access from any project. In GitLab 18.0, this changed to requiring explicit allowlist entries. Projects still using the old settings or with empty allowlists will lose cross-project access when 18.0 enforces the allowlist.
world-readable for httpd is not always set by vufind-php