X (Formerly Twitter) disclosed a bug submitted by itsdavid: https://hackerone.com/reports/2257374 – Bounty: $250 [Source]