I do see how knowing that your app has vulnerabilties that you don't plan to fix could be stressful. :)

Whether github is doing it or not, the baddies will be using similar tools to scan I'm sure.