this came very close to exposing private repo details to the wrong users for me recently

currently trying to find an exploit using this 'feature'