HackerOne disclosed a bug submitted by alp: https://hackerone.com/reports/1664920 – Bounty: $500 [Source]