security@company.com will usually get you a person that knows how to handle these reports.