HackerOne disclosed a bug submitted by jay: https://hackerone.com/reports/2552205 – Bounty: $2500 [Source]