Are you pointing a subdomain you own to a GitHub Pages site hosted from a private repository? If so, then yes, this is expected. Any files you have in publishing source of your site—either the master branch, the gh-pages branch, or the docs directory, depending on how your site is set up—will be publicly available on the internet. In order for your site to load a browser would need to be able to access and download the code for your site before rendering it on whatever device you were viewing the webpage from.

If you don’t want certain code exposed on the internet then you’ll need to move it out of the publishing source of your site—out of the master or gh-pages branches, depending on your chosen publishing source—or delete it entirely from your repository.