Ask HN: How to deal with bug bounty hunters (as a small SaaS business)?

We've recently been contacted by an Indian bug bounty hunter. He claims to have found a couple of security issues on our site, but doesn't want to disclose any details before we come up with a bug bounty amount that we'd be willing to pay to him for disclosing his findings. Is this professional behavior? What should we do?