Rate limits for private vulnerability reports

Are we also rate limiting how many vulnerabilities malicious actors can find?