GitHub disclosed a bug submitted by inspector-ambitious: https://hackerone.com/reports/2329547 – Bounty: $10000 [Source]