You make the assumption that code is public and in a git hosted service. Neither of those are necessarily the case.

You can unintentionally expose your repository by deploying .git by mistake.