neonerosion

That's not really plausible in the modern legislative environment (pun intended), considering your env vars will contain GDPR-controlled data like your username, at the very least. Combined with the IP address it was collected from, they know who you are and where you live.

The few details given in this response don't match up with what happened.

Who did the GDPR review before extracting env vars from systems that were not under your control? How did actively extracting potentially private data from the environment not get flagged as Unauthorized Access?

If this "experiment" (which happened to be against a competitor, mind) was reviewed and approved internally, that is a great demonstration of Snyk's approach to (ir)responsible data collection and disclosure.