Excluding sensitive commits

Hi! We are developing on a private repo and using copybara to move the code over into a public repo. Sometimes, we develop fixes for sensitive bugs that we do not want to copy over until it is fixed and released. Turning off copybara is not an option. To "hide" from copybara, we've been developing on branches that do not have copybara enabled, but having to manage multiple branches and their remerges are getting tedious.

The sensitive changes are not contained in a certain file, or we would be able to leverage the exclude[file] logic.

Is there a way to tell copybara to not copy over certain commits, e.g ignore commits that include [INTERNAL]? Would love to hear how other folks have handled this as well! Thank you.