U.S. General Services Administration disclosed a bug submitted by toormund: https://hackerone.com/reports/1218461 [Source]