How to respond to unsolicited vulnerability report from users of public sites?

We have a person who sends us "vulnerability reports" using burp suite to find issues on our website. What is the best way to handle these emails? Is there an industry best practice on this?

best practice burp burp suite cybersecurity emails find industry practice public report reports respond vulnerability vulnerability reports website what is