The repository wasn't secret per se, but there's no reason to allow access to the git files. Thanks to Ben Stock and CISPA for notifying us.