A.S. Watson Group disclosed a bug submitted by alp: https://hackerone.com/reports/1618100 – Bounty: $5111 [Source]