https://hackerone.com/reports/5417 Part 1