We've emailed to Medium's security department about this issue, and the reply says that the method is intended.

https://github.com/swapagarwal/mediumship#disclaimer