Researchers demanding bounty - response?

Hi,

How do you respond to ethical hackers/"researchers" wanting bounty for stuff you already know (but not yet fixed) or they seem a bit "scammy"?

We are getting contacted by several persons wanting bounty for vulnerabilities. Some email from gmail addresses, others do have a custom domain but very little information is provided. No initial reports, no links to bounty platforms or personal contact details etc.

Also, all of them have failed to use the email address stated in security.txt. …

bounty cybersecurity researchers response