When I created a new repo I made it private, expecting that only I would have access to it. Apparently that's not the case though, since the defaults also gave write access to one of my user groups (I only have one, so maybe all user groups). This should be either changed or clarified, I think. In the settings for issue tracker/wiki it says "visible only to people who are explicitly granted access".
Issue #4221 invalid