Shopify disclosed a bug submitted by blaklis: https://hackerone.com/reports/2207248 – Bounty: $5000 [Source]