Not really strange. I generally don't report security vulnerabilities either when I find them. Sure, if it's a simple process to file an issue, or I know a know

Not really strange. I generally don't report security vulnerabilities either when I find them. Sure, if it's a simple process to file an issue, or I know a knowledgeable person in charge of the system, I'll do it. But otherwise I simply don't feel like explaining it. I don't feel I have the moral obligation to jump through hoops to get through all the customer bla-bla to someone who understands, and face legal issues, just because I bump on some 'bug'. Someone else will find it eventually. Choose your battles carefully and such...