Shopify disclosed a bug submitted by ashketchum: https://hackerone.com/reports/1147433 – Bounty: $5300 [Source]