drone follows the same convention as GitHub and uses a 404 to prevent leakage of private repository to anauthorized users [1]
Requests that require authentication will return 404 Not Found , instead of 403 Forbidden , in some places. This is to prevent the accidental leakage of private repositories to unauthorized users.