Hiya @znasgo ! This is indeed how our system is built. Please check out this support guide our staff wrote about how you can access private repositories within our build environment, since by default, we intentionally drop those permissions before your build starts:
A way you could potentially workaround this - since this is happening before your build command starts up (while we are attempting to install dependencies for you) is to instead use a submodule for this dependency. We do automatically clone submodules (using git submodule update -f --init once we’ve cloned your primary project) while we still have your git permissions. Those permissions are dropped immediately after cloning/fetching/submodule’ing, before we start installing deps.