[maybevain]

There's also the added benefit of being able to list the github.io domain on the Public Suffix List [1], which means that no cookies can be set for the top level domain, only the *.github.io subdomains. This prevents the platform users from accidentally revealing their cookies to every other app under the top level domain.

EDIT: to ellaborate for the interested, the Public Suffix List is used by browser vendors to decide what part of the URL is considered the TLD for display and cookie security purposes (and I imagine others).

[1] https://publicsuffix.org/