HackerOne disclosed a bug submitted by fanimalikhack: https://hackerone.com/reports/2079502 – Bounty: $1000 [Source]