Potential security problem(s)

[intrigus-lgtm]

Hi, could you please create a new draft security advisory and
invite me to it?
Any other private communication channel would also be fine.
I think I've found a potential security problem.

My disclosures always follow Github's 90-day disclosure policy (I'm not an employee of Github, I just like their policy).