GitLab disclosed a bug submitted by mike12: https://hackerone.com/reports/723307 – Bounty: $3500 [Source]