Anyone can Access Deleted and Private Repository Data on GitHub ◆ Truffle Security Co.

tl;dr - If a project has been forked or is a fork, you can bruteforce short commit id to see commits from other projects. It doesn't matter if those projects were deleted or made private.