Comment by kgeist

>Having everything behind auth defeats the point of making the repos public.

Maybe add a captcha? Can be something simple and ad hoc, but unique enough to throw off most bots.