The first (and only) security report I made to Google was denied then immediately patched (about 10 years ago).