Why don't you upload the source code for every release as a tarball (it would not require you to have any jind of public repository) or just disable contributions in case you want to use a git repository.
Brave doesn't have a VPN built in, only Tor. That feature also wouldn't be a VPN (like Opera for example says), it would be more of a proxy
I wonder why this browser is not open source. If it has no trackers to hide there should be no reason to hide its source code. I will not enter my personal data into such a browser.