From the looks of it, they actually asked for a way to report.
email security@company
Yeah. I'm just saying how it could have been overlooked. Doesn't excuse it, though.
email security@company