Yes. If they did this, private commits might even leak into packfiles fetched from GitHub by git.