U.S. Dept Of Defense disclosed a bug submitted by notajax: https://hackerone.com/reports/1825942 [Source]