We recommend that you only use {% data variables.actions.hosted_runner %}s with private repositories:
- Forks of your repository can potentially run dangerous code on your {% data variables.actions.hosted_runner %} by creating a pull request that executes the code in a workflow.
- You could incur unexpected costs if you allow forked repositories to run jobs on your {% data variables.actions.hosted_runner %}s.