GitHub Security Lab disclosed a bug submitted by jorgectf: https://hackerone.com/reports/1602237 – Bounty: $4500 [Source]