Indeed, fantastic job!
Credit where credit's due to HackerOne co-founder jobert, too. Seems he's made a decent living [0] out of making GitLab more secure.
On the flipside, as a GitLab user, I'm glad to see you guys are so generous with bounties to encourage more detailed (and fascinating) reports like these. :)
[0] https://hackerone.com/jobert?order_direction=DESC&order_fiel...