GitHub disclosed a bug submitted by inspector-ambitious: https://hackerone.com/reports/2332551 – Bounty: $10000 [Source]