If you don't have a bug bounty program (sounds like you don't), be upfront about it. You are probably still interested in what the user has to say, though it's

If you don't have a bug bounty program (sounds like you don't), be upfront about it. You are probably still interested in what the user has to say, though it's most likely something caught by automated tools, so ask them if they are willing to share the details and how a vulnerability is reproduced without the expectation of a payment. I do not suggest hinting how you'd check with management if you are willing to pay out a bounty (even if you are), since they might simply stall in letting you know the details even if the answer turns out to be no. Ofc, it'd be good to set up a bug bounty program so you are not caught off guard the next time. Even then, 90% of things you get are unlikely to be actual vulnerabilities, but you want to know when they are.