U.S. Department of State disclosed a bug submitted by carpc: https://hackerone.com/reports/1822665 [Source]