HackerOne Bug Bounty Disclosure: http-request-smuggling-in-transform-rules-using-hexadecimal-escape-sequences-in-the-concat()-functionbyalbertspedersen