@bagder and holy mackerel, *they opened a GitHub account just to make this report rather than going to HackerOne*

The account has *zero* other activity