The policy should state what a report should contain (Annex B lists the information to request): affected product and version, description, steps to reproduce, proof of concept, perceived impact, the reporter's contact details and preferences.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.