It's no different than sharing a link to a file in your Google Drive accessible only to people with the URL.

Encryption doesn't play the role you seem to think it plays here.

Yes, aka encrypt it.

> Or I could give it a unique undiscoverable URL.

…which is not possible if the repository is public.