GitHub disclosed a bug submitted by ajxchapman: https://hackerone.com/reports/1593913 – Bounty: $17500 [Source]