[bink]

You're right that having security report to engineering is not unusual. It's also not a great idea due to conflicts of interest, but not unusual.