Privacy or security spill

You gave a person, app, or AI more data, access, storage time, or audience than the job actually needed, so harm can happen even when everything works correctly.

You want help reading a blood panel, so you photograph the whole lab report and paste it into a chat assistant, then connect the running app to the same account so it can factor in your training. You wanted one number explained: why your ferritin is low. What you handed over was your full name, date of birth, doctor's name, three years of results, your contacts list, and a map of every run that starts at your front door.

This is a spill: the packet carries more data, access, retention, or exposure than the operation needs. The tell is a gap between the question you asked and the scope you granted. Nothing looks broken, which is why it goes unnoticed until the data surfaces somewhere you never chose. The cost lands later and cannot be pulled back. The correction is small. Ask what the single task actually requires, crop or redact everything else, grant the narrowest permission and the shortest storage window offered, and check who else can see the result. Here that means one line of numbers with the header cut off, no account link, no shared map. False alarm when the extra context genuinely changes the answer and the recipient is one you would tell anyway, and refusing to share with your own doctor is not caution, it is worse care.