Slack disclosed a bug submitted by security_warrior: https://hackerone.com/reports/1661310 – Bounty: $250 [Source]