I don't really get what the risk to proprietary information? The only thing that leaks for private repos would be the URL and version number, right? While opt-

I don't really get what the risk to proprietary information? The only thing that leaks for private repos would be the URL and version number, right? While opt-out for this not ideal, this seems like a minor privacy risk relative to the security risks ameliorated by enforcing checksums by default. I guess an option which solves would be a mandatory prompt about proxy usage unless there is an explicit environment variable set?