GitHub Security Lab disclosed a bug submitted by farid_hunter: https://hackerone.com/reports/1943049 – Bounty: $1800 [Source]