[Not sure if bugs.debian.org is the right pseudo-package for bugs with
reportbug.debian.org, but it seemed like the most likely candidate.]

With reportbug's default configuration of relaying through
reportbug.debian.org, if you follow reportbug's prompts to report security bugs
privately to the security team, you get:
SMTP send failure: {'team@security.debian.org': (550, 'relay not permitted')}. Do you want to retry (or else save the report and exit)?  [Y|n|q|?]?

Here's a (slightly redacted) transcript from a recent reportbug session:

[...]
Do any of the following apply to this report?

1 d-i       This bug is relevant to the development of debian-installer.
2 ipv6      This bug affects support for Internet Protocol version 6.
3 l10n      This bug reports a localization/internationalization issue.
4 lfs       This bug affects support for large files (over 2 gigabytes).
5 patch     You are including a patch to fix this problem.
6 security  This problem is a security vulnerability in Debian.
7 upstream  This bug applies to the upstream part of the package.
8 none

Please select tags: (one at a time) [none] 6
- selected: security
Please select tags: (one at a time) [done]
Are you reporting an undisclosed vulnerability? If so, in order to responsibly disclose the issue, it should not be sent to the public BTS right now, but instead to the private Security Team
mailing list. [y|N|q|?]? y
Spawning vim-wrapper...

Report will be sent to team@security.debian.org
Submit this report on [package name] (e to edit) [Y|n|a|c|e|i|l|m|p|q|d|t|s|?]?
Connecting to reportbug.debian.org:587 via SMTP...
SMTP send failure: {'team@security.debian.org': (550, 'relay not permitted')}. Do you want to retry (or else save the report and exit)? [Y|n|q|?]?