I participate in a couple programs, and when I report something, they have a team at the bug reporting service take a look first before escalating them to the a

I participate in a couple programs, and when I report something, they have a team at the bug reporting service take a look first before escalating them to the actual security contact. Only issues that are in-scoope and severe enough get escalated. The company can even mark certain programs as invitee-only or for researchers above a certain threshold. Many programs already have rules saying they will not consider DNS/header related issues.