Stripe disclosed a bug submitted by fisjkars: https://hackerone.com/reports/1121896 – Bounty: $500 [Source]