Our security@ address at $dayjob gets about that many a month. Lots of folks blindly sending bug reports and “politely requesting a finder’s fee for disclosing properly.”
The shit of it is, they’ll all for stuff we don’t even use. IIS vuln reports when we only use Apache. Stuff like that.
I can’t tell if you’re taking the piss or not about re-implementing initscripts.