Even if you don't have cryptocurrency they can still go after your GitHub credentials and run some very expensive agent and runner workloads.

I've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.