I'm guessing that this is actually some setting I have wrong, but after a while of looking, I haven't been able to find it. On our phabricator instance, we have restrictive projects for groups, and then each repo belongs to one of these projects. If a user who is not in the project attempts to view the repo's source, phabricator blocks them as it should.
If the same user goes into the Audit application and selects "All Commits", they can then see the commits and the summary text (although they do not have access to view the commit object itself). Can this be disabled with a setting change?