Stripe disclosed a bug submitted by ian: https://hackerone.com/reports/1849626 – Bounty: $5000 [Source]