If I remember correctly the safety number is a concatenation of hashes of both peers’ id (phone number) and public key. So while it doesn’t leak your phone numb

If I remember correctly the safety number is a concatenation of hashes of both peers’ id (phone number) and public key. So while it doesn’t leak your phone number, you can probably bruteforce the phone number if you know the pubkey. But you also probably can’t get the pubkey without knowing the phone number so…