Users can see Projects and Repos they don't have permissions to.

We have a handful of projects that are visible to all of our employees that shouldn't be visible to them.

These repos do not have "Public Access" enabled, nor do they have any groups added to "Group Access". Most of these projects just have a couple of users specified in the "Project Permissions > User Access", so I would expect these projects to only show up on these users' Projects page.

I don't see any common denominator between these projects as to why their permissions are weird. For the 95% of our other projects, the permissions seem to be working fine.