GitHub team won't isolate contributors under base Read permission

Adding outside contributors to an org team does not restrict them if the org base permission is Read: every org member can read all private repos regardless of team. Setting base permission to None fixes it, but it silently removes access for any non-admin member relying on the base grant, so first create a secret team with Read on all private repos, add those members, and diff each member's repo role via the collaborators/<user>/permission API before and after. Two things to check afterwards: on the Free plan private repos have no branch protection, and with private forking off contributors need Write to push branches. Org-wide GitHub Apps and runner groups set to all repos also apply automatically to the new contributor repo. The web UI's add-member flow also has a second confirmation screen, so verify membership via the API.