This happened before I started there, but from my understanding it was patched as soon as it was discovered. It was a tricky thing to catch since it's not something that readily shows up unless you're spying on every one of the tens of thousands of client sessions, and this was before YouTube when someone would've posted a video about it for clout.