Liberapay disclosed a bug submitted by suprnova: https://hackerone.com/reports/1727044 – Bounty: $100 [Source]