Ask HN: How do I respond to someone claiming he has an exploit on my site?

He's gone straight to asking if we'll pay for an exploit. I'm pretty sure it's a scam but obviously don't want to get in a situation where we've ignored a real issue. We don't have an official bug bounty program, but we'd be happy to pay out if it turns out to be a real exploit. What's the right course of action here?