[Koshima]

You’re definitely not the only one. I’ve seen a few discussions recently about unexpected billing for GitHub’s “code security” features. It seems like the feature gets auto-enabled without clear communication, and turning it off isn't straightforward.

One thing you can try is reaching out directly to GitHub support via their official Twitter account. Sometimes their social media team responds faster than traditional support. Also, check if any new team members or integrations could have triggered the feature.