I've had this happen for pretty large companies. In one case their security team later gave a talk about bugs they'd discovered that included a diagram I'd sent

I've had this happen for pretty large companies. In one case their security team later gave a talk about bugs they'd discovered that included a diagram I'd sent in my description of an issue, which I found annoying. These days I generally just sit on issues. The work involved in putting together a bulletproof report that can be understood by whoever reads the security alias (could be a security engineer, could be a PHB, could be /dev/null...) is just too high to do for free.