I suppose I could just add any repo I care about not sharing under a new organization. I see that it doesn't auto-share those.

With Clerk I have no ability (or I haven’t figured it out) to be more finegrained with the permissions — will be swapping that out soon But it should still work if you deny all repos