details removed as per suggestion from security researcher at HN