I would argue that even then it should be public. Forks exist and everyone can have one (even if it is for private use). For all we know the maintainer of the "

I would argue that even then it should be public. Forks exist and everyone can have one (even if it is for private use). For all we know the maintainer of the "original" could be a hostile actor.