GitHub disclosed a bug submitted by inspector-ambitious: https://hackerone.com/reports/2185545 – Bounty: $4000 [Source]