inDrive disclosed a bug submitted by cypher-28: https://hackerone.com/reports/2300358 – Bounty: $2000 [Source]