A new-device alert with nothing in it

I was trying to log into Uber this morning and received an email saying my account had been signed into from a new device.

That's a great feature from a security perspective. The only downside was that it was all placeholders, with almost no information except an IP address. I knew the IP was valid because I know my own IP address, but I'm not sure how many ordinary users would. It's probably not the best idea to send half-baked information.

Why I'm posting this

The general idea is that I'd benefit from helpful feedback, and so would others.

What would have helped

There's a convention called security.txt: a file that says who to contact with findings like this. Without it, a lot of people come across issues like this but have no channel to report them.