If you only need a bare minimum, and don't plan to heavily use CI/CD, container/packages registries, integrations with other tools i would go with gitea/forgejo (you can always use external tools on top), else i would use selfhosted Gitlab, it has pretty much all the things you could imagine to need with software development and deployment
It doesn't matter that website loads javascript code for logged in user, as you need a token (which server will give you after a successful login) to authenticate to apis, it is pretty common to do that way
There wasn't a client side API, but the API was missing crucial validation of user input (eg only checking the mac address but didn't check who is actually authenticated)
thankfully that is a special mailbox for spam, I sometimes like to come through the emails and see where they submit the data, and maybe submit some data on my own, plus report the issue to website owner/hosting
it depends on your email provider/server, search under term "catch-all" or alias. I'm using a self hosted email on hestiacp, which have a option under domain email settings
At my instance I did setup a email wildcard (receive emails from any address on that domain which don't already have a account) and I get a lot of phishing and scam emails, most of them are send "to" /c/meta@femboys.bar, as link to this community is linked in sidebar, but I also seen emails "send to" random usernames
So yeah, It is happening, i wonder how bad it is on larger instances
I doubt it was a real wallet - most likely it was just a scam exchange that would prompt you to send cryptocurrency "for verification" before you could try to withdraw them.
The idea was already exploited on prnt.sc, where it is possible to try bruteforce screenshot ID and find other users public screenshots - https://splashdot.github.io/scam1/
If you only need a bare minimum, and don't plan to heavily use CI/CD, container/packages registries, integrations with other tools i would go with gitea/forgejo (you can always use external tools on top), else i would use selfhosted Gitlab, it has pretty much all the things you could imagine to need with software development and deployment