HackerOne disclosed a bug submitted by the_arch_angel: https://hackerone.com/reports/2011431 [Source]