Sorry, it's from [0] linked further down in the comments. I didn't notice that when posting, or I would have made my comment a reply to that post [1].

[0] https://github.com/google/security-research/security/advisor...

[1] https://news.ycombinator.com/item?id=27842381