yes, they can, and you can clone other people projects.
But that’s kinda the point of open source, people clone a
project, fiddle with it, and propose improvements to the original version
anyway, you can have private repositories in the premium version of github
You should be careful about what you include in your check-in. It is insane how many Github projects include passwords or other sensitive info. You might want to take a look at how to use a .gitignore file to make sure that sensitive files are ignored when checking in your project.
This generally isn’t a problem worth worrying about, especially when it comes to stuff like portfolios or side projects created for the sake of learning.
Open source is built on the fact anyone can clone/copy the code. At the same time you shouldn’t “open source” your secure secrets (like database passwords), nor should you open source your entire application stack if your goal is to make money with it.