We just discovered this today. We were rather alarmed to find, under an issue for a public repo, a link to a PR in our private repo.

Fortunately, in incognito mode it disappeared, and also when logged in under a different account. So it's not visible to everybody. But for a moment it was a very unpleasant surprise.