docs/data/reusables/actions/hosted-runner-security.md

We recommend that you only use {% data variables.actions.hosted_runner %}s with private repositories:

• Forks of your repository can potentially run dangerous code on your {% data variables.actions.hosted_runner %} by creating a pull request that executes the code in a workflow.
• You could incur unexpected costs if you allow forked repositories to run jobs on your {% data variables.actions.hosted_runner %}s.