[jaywalk]

It sounds like these badges will only come from public commits, and you can also turn them off. So I don't think your concern is warranted.

[sodality2]

It has given me badges for PR's in private repositories, it just doesn't display what repo or any additional information (listed as "inaccessible")