the public/private question is answered by another goat, bit I wanted to comment on how weak this attack is. every developer who clones a repo to work on has the entire copy of the code and all commit messages. that means that someone has the last state the repo was in, even if that work wasn't yet pushed to the repo. Repo gone? no big deal, let's make a new repo, change where the remotes direct to and push code.

making the code public is really the only threat, which may be a big deal to some organizations.