Definitely had a private GitHub dependency disappear once. Vendoring saved us a massive headache downstream.