GitHub Security Lab disclosed a bug submitted by ihsinme: https://hackerone.com/reports/1950659 – Bounty: $1000 [Source]