All of your content will be publicly accessible in an automated way that requires no understanding of your site if github turns on PROPFIND and there are dozens of reasons (many good) why they would.
If you actually care about the content on that site staying secret you should delete that repo and find a different way to share it.
All the contents of my house are publicly accessible to anyone who wants to break a window--this data is less important than any of that stuff, I just didn't want it sitting out on the curb, so to speak.
Edit: I hadn't thought about WEBDAV being an entry point, though--thanks for pointing that out.
Automated crawling is way different than physically breaking and entering. One is a (legal!) routine process executed by robots and one is a serious crime that requires will, forethought, and physical presence.
Automated crawlers were not the threat I was trying to guard against--it's more the 40 year old creep looking for pictures of kids on people's blogs and being bold enough to leave disgusting comments that I wanted to get away from--problem solved.
If you actually care about the content on that site staying secret you should delete that repo and find a different way to share it.