Treat internal/private repos as `sensitive_packages`