Reported a security bug to Salesforce and was recognised via their responsible disclosure program!