Look through your access logs and see if you can figure out what they found. If you can’t, talk to them about what kind of exploit it is (so you can agree on a

Look through your access logs and see if you can figure out what they found. If you can’t, talk to them about what kind of exploit it is (so you can agree on a reasonable payout) and then pay on the condition they do a non-destructive demo of the exploit.