Curious what the GDPR implications are, does Claude (even accidentally) including emails + employers + repo names count as a personal data breach? Seems likely it could be an unauthorised disclosure (which requires reporting within 72h)

Also from a design perspective, I feel like including email and other personal data into the context is a bad idea for "data minimisation" reasons