HackerOne disclosed a bug submitted by byq: https://hackerone.com/reports/2228413 – Bounty: $100 [Source]