GitHub's own docs say so. Anyone who finds the URL can read the whole thing, logged in or not.
Secret means unlisted: kept out of Discover and search. It does not mean access-controlled.
You can switch a secret gist to public whenever you like. You can never switch it back. Deleting is the only way out.
gh gist create makes a secret gist unless you pass --public. People assume they published and never appear in Discover.
The embed is a script tag, and GitHub strips scripts from rendered Markdown. Link to the gist or paste a fenced block.
Your six profile pin slots cover repos and gists together. Four repos plus two gists and you're full.
Every gist is its own Git repo, so a fork is an independent copy. Deleting yours removes nobody else's.
Public versus secret, embedding, pinning, and when a gist should have been a repo.