@snail it was submitted as a security problem over at hackerone and we have not disclosed it, simply because its not worth spending time on