GitLab disclosed a bug submitted by vakzz: https://hackerone.com/reports/1685822 – Bounty: $22300 [Source]