GitHub disclosed a bug submitted by ali_shehab: https://hackerone.com/reports/1690427 – Bounty: $7500 [Source]