2 of these findings are github.com's own hosts. The engine compares hostnames after stripping a leading www., so every subdomain counts as a separate party. Those rows are marked.
What the page loaded
The gap
What the policy says
UndisclosedLoaded on the page, named nowhere in the policy's third-party list.3 findings
github.githubassets.com
a host the registry does not recognise
Undisclosed
not named
collector.github.com
a host the registry does not recognisethe site's own domain
Undisclosed
not named
api.github.com
a host the registry does not recognisethe site's own domain
Undisclosed
not named
What this check cannot tell you. It reads what the page contacts and what the policy says. It does not review consent-management configuration, data retention, or anything not visible from the outside of the page. The corrected text it drafts is not a legal opinion.