A few points worth addressing:

• The scattered if ctx.PublicOnly { private = false } checks across 6+ handlers are fragile and easy to miss when adding new endpoints. A cleaner approach would be to push PublicOnly into the query layer: add a PublicOnly bool field to the search/find option structs (SearchRepoOptions, FindOrgOptions, StarredReposOptions, WatchedReposOptions, etc.), set it once from ctx.PublicOnly, and let the database queries handle the exclusion. For entity-level checks (like GetByID), a centralized tokenCanAccessRepo(ctx, repo) called from repoAssignment() would also reduce the surface area for missed checks.

• rejectPublicOnly() hardcodes "token scope is limited to public notifications" — should use a generic message like "this endpoint is not available for public-only tokens" or accept a parameter.

• The explanatory comment about notifications is placed after the middleware registration — should go before it.

• TestAPIActivityFeedsPublicOnly asserts Empty(t, activities), which only works because all test fixture activity happens to be on private repos. If someone adds public activity for user2/org3, the test would still pass but no longer actually test the filtering. Better to assert that no returned activity references a private repo.

The switch → for fix and the notification rejection approach are solid as-is.

This comment was written with the help of Claude.