GitLab disclosed a bug submitted by moblig: https://hackerone.com/reports/2528293 – Bounty: $1160 [Source]