that's a hackerone bug, that 8-year-old report is not mine :)