Slack disclosed a bug submitted by salh4ckr: https://hackerone.com/reports/1716016 – Bounty: $10000 [Source]