They mostly use public repositories though.

Yeah, but that should also be a red flag.