Comment by nulld3v

It is already known to be true for repos that are forks or have been forked: https://trufflesecurity.com/blog/anyone-can-access-deleted-a...