Judge.me disclosed a bug submitted by penguinshelp: https://hackerone.com/reports/1397940 – Bounty: $500 [Source]