actually that wasn't a bot. the volume of security reports is too low to require an automated task. that mail was probably sent out by someone from the security team. It is a form letter, but that's for consistency across responses.