GitHub Security Lab disclosed a bug submitted by sim4n6: https://hackerone.com/reports/2006913 – Bounty: $1800 [Source]