FWIW we've also received the exact same email from the same named person with the same vague text of having "identified a vulnerability in your Web Application"

FWIW we've also received the exact same email from the same named person with the same vague text of having "identified a vulnerability in your Web Application", judging from Troy's twitter thread he seemed to have sent the same email to many others. We're still waiting on a reply to asses whether there's any validity in his claim. I guess what I'm curious is how do people best handle this situation? Normally if it's any other pc security threat or legal liability claim cold emailing us we'd just report spam & ignore but with a software vulnerability we're at duty to investigate, which I expect would make his vulnerability claim so effective with engagement. Given this happened shortly after we added a SECURITY.md to our project with the contact email used, it wouldn't surprise me if he is just email spamming the same claim to projects with SECURITY pages where he'll expect some payment for just disclosing a GitHub reported dependency vulnerability that nearly every non-trivial npm project has.