They have a bug bounty program: https://developer.apple.com/security-bounty/

I actually think they have a good approach. Rewarding major finds with good payouts and avoiding the flood of info and low level web app ‘bugs’.