A race condition in charmbracelet/soft-serve's SetPrivate function causes a private repository to remain readable by unauthenticated users until the server restarts. The issue arises because the repository visibility cache is cleared before the database commit, allowing a stale public record to be cached and used for access checks after the repository is made private. This stale cache persists until eviction or server restart, enabling continued unauthorized read access over HTTP, SSH, and git protocols. The flaw affects versions 0.6.0 through 0.12.2 and is fixed in version 0.12.3.