Reporting a security bug doesn't count as a contribution to you?

When the complaint is that there isn't a way to report a security flaw surely that's a reason to complain.