I don't understand how anything like this could just assume that I'm going to give it access to my private repos. Do people seriously do this?