The reason why GeoServer (as every server compliant to the OpenGIS Webservice-format) provides this function is to be able to determine what your WMS or WFS is able to do, which kind of data they use (spatial reference, accuracy, layers), what the extent for them (bounding box) is and who might be responsible for issues when having problems on dealing with the service (service-admin).
I strongly would not recommend do deactivate this, as it is needed for every kind of automatic search for your service. The function simply provides metadata about your services, I doubt there are security-issues which it hands out.
Even noticing that you´re using the service only yourself does not justify disabling this as there might be collegues that do not understand every single parameter or every method that is provided by your WFS for exapmle. Looking into the document simplifies the process on getting all those information.
However if you really have to do this you may simply deactivate the servlet which is related to the function. As GeoServer is a simple servlet-container it provides a web.xml
-file which you may modify. Simply delete the mservlet-mapping for GetCapabilities
and you´re done. See this doc from oracle for how to do this.
Anyway I doubt you can do much without the function, as many products (ArcGIS, OpenLayers, ...) use this information before even making any request for your actual data.
GetCapabilities
reveals? Usually the actual data is much more security relevant. Are you scared someone could write you an email? Don´t provide your mail-adress.