Elsewhere perhaps, this seems like a pretty standard/legit security flaw in a new application which is found and hopefully quickly closed.

If your information is sensitive, do not use an LLM by public API - absolutely all of your data is being stored and processed. For all of them.