Microsoft own GitHub you know? They could legitimately look at code in every single private repo, describe it as maintenance or security/vulnerability scanning, and give the whole lot to the NSA for increased funding / political capital, and no one would blink an eye?