Hat tip for the public handling of this issue. Second one for the initiation of a bug bounty, while not the end to all, it does help to get critical hands and eyes to your code.