I've been chatting with thealx about the issues he raised, which won't be disclosed here.
However, it means that I'm going to pay for Github pro, and make the repo private. I don't mind paying, as it's only $7 per month, or $84 per year. I'll keep it monthly for now, then if there's going to be continued development work, we can dicuss paying for it for a year. And if I ever get to the point of not wanting to be the admin anymore, I'll arrange handing over to someone else.
The Pro account will also give us more control over access to the code as well, so it's probably for the best. Everyone that's using the repo at the moment is on as a collaborator, so access shouldn't change.