Google Issue Tracker lets outsiders report vulnerabilities, so you'd imagine it's locked up tight...