Or add a signed timestamp to the URL after which it isn't valid anymore. So the URL can't be used without opening the actual comment on GitHub.