You pasted a failing curl into Copilot chat to ask why it returns 401. The paste included the Authorization: Bearer eyJhb... header. Your token is now in the Copilot request log, and — depending on your org's settings — in a model provider's cache too. You didn't "leak" it in the old sense. No commit, no push, no public repo. But it left your machine. This is the new leak vector. It's faster than