Pretty much what you said in the third para is a fine reply IMO, see how it goes from there. Up-front and authentic. A lot of people reporting these are doing

Pretty much what you said in the third para is a fine reply IMO, see how it goes from there. Up-front and authentic. A lot of people reporting these are doing automated scans anyway, so it's not like they spent all day combing your site back to front. You may also receive an automated notification of the same bug through e.g. openbugbounty.org.