The challenge is you get tons of nonsense that you have to respond too. Researchers all want to publish it as a big bug, etc. wastes tons and tons of time, so painful. Even if you explain why it's not a problem they remain convinced ðYz
90%+ security reports I've seen are non-issues.