Shopify disclosed a bug submitted by nagli: https://hackerone.com/reports/1569940 – Bounty: $1600 [Source]