This will ultimately be fine for what I am doing because I am not defending a high-value target against a determined attacker, but...

I would not trust any insider protection I could build on GitHub honestly. I'd just assume anyone with Write has the keys to the castle.

That's worrying.