You caught me. Tina is my co-founder, so those are her business contacts, but you're absolutely right, still a dumb move to leave them exposed instead of routing everything through single secure point of contact. I completely missed them when I dumped our raw resumes into the RAG context.

My oversight for blindly claiming the logs were totally clean. I just updated the backend and permanently scrubbed the contacts.

Genuinely appreciate you pushing back and catching my blind spot!