Given that no threat or demand was made, this sounds like they were just notifying you of a vulnerability. Does your company / product have an official respons

Given that no threat or demand was made, this sounds like they were just notifying you of a vulnerability. Does your company / product have an official responsible disclosure policy?