How to deal with unsolicited vulnerability bounty requests?

From time to time, a message pops up in my inbox:

"We've uncovered some vulnerability in your ..., here is how to reproduce it. We hereby request a bounty from you for this work."

These are not spoofed messages. But such requests are not solicited: we never publicly asked anyone to do ethical hacking.

How would you deal with these? If the vulnerability is validated, how much would you pay for it, assuming the resources are very limited.

Thanks.

bounty cybersecurity deal requests vulnerability