Search API seems to ignore `ref`, returns spurious results from `master`

Summary

ref is being ignored in search API

Steps to reproduce

Judging from https://docs.gitlab.com/ee/api/search.html#scope-commits, I understand that

https://gitlab.com/api/v4/projects/{x}/search?scope=commits&search={y}&ref={z}

should return the set of the commits that contain the string {y} in ref {z} of project {x}.

If ref {z} does not exist, behaviour is undefined but I would expect some HTTP error status or at least a body of [] .

This is not happening for me.

What is the current bug behavior?

Take for example GitLab itself: https://gitlab.com/gitlab-org/gitlab

It has project ID of 278964.

It has a commit e8c92405, which contains the string "199034-nomethoderror-undefined-method-unsubscribe-for-nil-nilclass" and a tag v11.11.0-ee, which at the moment of writing does NOT contain said commit nor any other commit with that substring.

Querying

https://gitlab.com/api/v4/projects/278964/search?scope=commits&search=199034-nomethoderror-undefined-method-unsubscribe-for-nil-nilclass&ref=v11.11.0-ee

returns HTTP 200 with

[
   {
      "id":"e8c92405088dc9396dc40305f3ddb4e72099b050",
      "short_id":"e8c92405",
      "created_at":"2020-01-28T11:41:21.000+00:00",
      "parent_ids":[
         "faa22f562156204161a309892c1397d13e396228",
         "c35e5b205bd0ac672a18435776863bc4135604b1"
      ],
      "title":"Merge branch '199034-nomethoderror-undefined-method-unsubscribe-for-nil-nilclass' into 'master'",
      "message":"Merge branch '199034-nomethoderror-undefined-method-unsubscribe-for-nil-nilclass' into 'master'\n\nResolve \"NoMethodError: undefined method `unsubscribe' for nil:NilClass\"\n\nCloses #199034\n\nSee merge request gitlab-org/gitlab!23747",
      "author_name":"Nick Thomas",
      "author_email":"nick@gitlab.com",
      "authored_date":"2020-01-28T11:41:21.000+00:00",
      "committer_name":"Nick Thomas",
      "committer_email":"nick@gitlab.com",
      "committed_date":"2020-01-28T11:41:21.000+00:00",
      "status":"failed",
      "last_pipeline":{
         "id":112900054,
         "sha":"e8c92405088dc9396dc40305f3ddb4e72099b050",
         "ref":"master",
         "status":"failed",
         "created_at":"2020-01-28T11:41:40.906Z",
         "updated_at":"2020-01-28T12:39:21.357Z",
         "web_url":"https://gitlab.com/gitlab-org/gitlab/pipelines/112900054"
      },
      "project_id":278964
   }
]

Setting ref to gibberish, as in:

https://gitlab.com/api/v4/projects/278964/search?scope=commits&search=199034-nomethoderror-undefined-method-unsubscribe-for-nil-nilclass&ref=asdjkfhaksjdfhasjkdfhajksd

results in the same exact behaviour.

What is the expected correct behavior?

I would expect to see HTTP 200 and a body of [], or HTTP 404, or some other HTTP error code in the case of the gibberish ref.

Output of checks

This bug happens on GitLab.com