If your repo was ever public while it was supposed to be private, you were compromised at that point though - but it's ironic that Microsoft's own tool is compromising Microsoft's own private code on Microsoft's own platforms.