Privacy concerns with SourceLink and AssemblyAttributes/AssemblyInfo

I manage an open-source project called Gameloop.Vdf at https://github.com/shravan2x/Gameloop.Vdf. I recently added some new features and decided to release a new NuGet version. I used VS2019's "Generate NuGet package on build" option to build the .nupkg and tried to enable SourceLink by adding this code to my .csproj:

```c#

$(AllowedOutputExtensionsInPackageBuildOutputFolder);.pdb

```

The rest of the .csproj can be seen at the repo [here](https://github.com/shravan2x/Gameloop.Vdf/blob/master/Gameloop.Vdf/Gameloop.Vdf.csproj). It already contains the `https://github.com/shravan2x/Gameloop.Vdf` field.

On build, the .nupkg file generates without errors. However, NuGet Package Explorer shows that while symbols are present, SourceLink isn't valid. In addition, it seems to include files I don't recognize - `AssemblyAttributes.cs` and `AssemblyInfo.cs` (both shown in the picture below). **While all other links in the .pdb section opened the correct file from my GitHub project, the AssemblyInfo.cs file 404'ed**.


I then tried adding the `true` field in my .csproj. This build also succeeded and now SourceLink was marked as Valid. The only noticeable difference in NuGet Package Explorer was that `AssemblyInfo.cs` was no longer a link, but regular text (see image below).


My questions are:
1. I would rather not enable the `EmbedUntrackedSources` option for concern that it may include files in the build that shouldn't be there. This is to some extent a privacy/security concern for me. In this case, all relevant files were in the repo anyway, so why didn't SourceLink work correctly without this option?
2. Even when `EmbedUntrackedSources` was disabled, the `C:\Users\Shravan\AppData\Local\Temp\.NETFramework,Version=v4.5.AssemblyAttributes.cs` file was included (which is not a public file from my repo). This is a privacy concern to me since it leaks folder structures on my personal machine, and is exactly the problem I was trying to avoid in (1). I expected that with `EmbedUntrackedSources` disabled, this file path wouldn't be disclosed in my NuGet package. Why was it?
3. When the `EmbedUntrackedSources` option was enabled, the problem is even worse - the `C:\Users\Shravan\Workbench\Visual Studio - Workspace\Gameloop.Vdf\Gameloop.Vdf\obj\Release\net45\Gameloop.Vdf.AssemblyInfo.cs` path is leaked, which contains even more private folder structures. Could you explain why the full path needs to be included in the NuGet package instead of a simple relative path (or even better, an artificial path to avoid privacy issues)?
4. I then tried inspecting a few other NuGet packages - Json.NET and SteamKit. Neither had either the `AssemblyAttributes.cs` or `AssemblyInfo.cs` files in their .pdb, but SourceLink was valid. Why were these files included in my .nupkg?

**Note that even including these paths for this GitHub issue made me uncomfortable. I only did so in the interest of preventing the issue from occurring for others who may be unaware of it.**