GitHub Security Lab disclosed a bug submitted by luchua: https://hackerone.com/reports/1690045 – Bounty: $1000 [Source]