GitHub Security Lab disclosed a bug submitted by r3xtwo: https://hackerone.com/reports/2006912 – Bounty: $1800 [Source]