Shopify disclosed a bug submitted by ssilvass: https://hackerone.com/reports/1940245 – Bounty: $500 [Source]