One alternative is mirror the repos and be in control of what your clients can see