inDrive disclosed a bug submitted by kristoferent: https://hackerone.com/reports/2051931 – Bounty: $4134 [Source]