from Hacker News

Was setting up Actions CI for a university project only to realize that private repo can't access org's Secret unless it is on a paid plan.

Shouldn't this be a security issue?

"Secrets are available in all public repositories, in private repositories owned by personal accounts, and in private repositories owned by organizations on GitHub Team or GitHub Enterprise plans."