GitHub disclosed a bug submitted by inspector-ambitious: https://hackerone.com/reports/2357443 – Bounty: $4000 [Source]