I'm not sure that addresses the question; likely I'm missing something. Why does it need to send the user's entire codebase over? If it's a question of needing to analyze a given source file to infer types so query results are relevant, then why not do that inference work client side and ship back just the type information to the server where the query is run?
Even if that is a step too far, you could strip out string literals (e.g. API keys), and obfuscate variable, method, type, and file names while retaining a map on the client side so results line up.
That seems possible with a strongly-typed language, but for something like Python, they'd basically have to recompile the code on every keystroke, right?
Even if that is a step too far, you could strip out string literals (e.g. API keys), and obfuscate variable, method, type, and file names while retaining a map on the client side so results line up.