diff --git a/src/applications/diffusion/controller/DiffusionServeController.php b/src/applications/diffusion/controller/DiffusionServeController.php
--- a/src/applications/diffusion/controller/DiffusionServeController.php
+++ b/src/applications/diffusion/controller/DiffusionServeController.php
@@ -102,6 +102,11 @@
         ->withCallsigns(array($callsign))
         ->executeOne();
       if (!$repository) {
+         // Repository was not found with the current policy
+         if($allow_public && $allow_auth && !$viewer->isLoggedIn()) {
+            // Repo might not be pubic even though phabricator is.
+            throw new PhabricatorPolicyException();
+         }
         return new PhabricatorVCSResponse(
           404,
           pht('No such repository exists.'));