People Interactive disclosed a bug submitted by zishanadthandar: https://hackerone.com/reports/703882 [Source]