GitHub Security Lab disclosed a bug submitted by porcupineyhairs: https://hackerone.com/reports/1943050 – Bounty: $1800 [Source]