Security Disclosure Policy Best Practices

The CEO of apple/oracle/mozilla/acme should not get a copy of every message sent to security@.