U.S. Department of State disclosed a bug submitted by hollaatm3: https://hackerone.com/reports/1747596 [Source]