We do have a private CVS repository, but it's not for super secret features.
Here's what's in it, and why:
-- our config files (bigip, nagios, dns, apache, cricket), not useful for other people to have
-- files listing our projects (assignments.txt), vendor_contacts.txt, contacts.txt (contact info for each employee)
-- server/asset tracking information
-- xcolibur site scheme: our branded site scheme, only private because everybody took and used our previously "ljcom" dystopia scheme, even though it wasn't open. (but it's mostly our fault for not documenting that in the past)
-- component and boxer S2 schemes. this is the closest to a "hidden feature" that's private, but hardly. it's just a scheme, like xcolibur. we paid for them to be developed. it's not core code.
So please, if you see rumors floating about that we're hiding all our new code in ljcomint, point people at this post.