More than that, even if a single person without any reputation reports a security issue, there should be some standard mechanism in the company to evaluate it and fix the problem if it's real.