Flickr disclosed a bug submitted by stevejubs: https://hackerone.com/reports/1581258 – Bounty: $258 [Source]