Users are going to use whatever mechanism to provide feedback that they find first. They don't know what's a security issue, what's a bug, what's a sales request, and what's a support request. All I can say is that I hope whatever system you use for collecting security reports is shared by those other teams, and you just change the "security" tag to "ui" and move on. Because if you don't do that, you know whoever is reading that "ui bug" queue also has a slack channel where they make fun of people filing security reports as ui bugs, and then proceed to drop them on the floor.

Always be careful about shipping your org chart.

Maybe you should pay UI bounties. You're certainly losing money if customers leave because your app sucks.

Well, did you forward it to the UI team...?

No, I marked it invalid and went on with my day. As the front line of security triage, I don't even work for the company and have no contacts on the UI team. You want me to escalate it to the internal head of security? It's not going to happen.

It’s not an escalation. This would rather be an opportunity to improve the triage process to account for cross functional bugs.