Occasionally bug bounty scammers don't send details about 'bugs' in their initial unsolicited emails and will instead send a normal appearing message asking for contact details of the person responsible for processing, dealing or managing website bugs, or the manner in which they should be reported. For example;
From: Nishant Prajapati <prajapatinishant1810@gmail.com>
Subject: Urgent: Security Concerns Found in Your Application
Body: Hello,
I hope this message finds you well.
I have discovered several security vulnerabilities within your application that pose potential risks to user data and functionality. It is crucial to address these issues promptly to safeguard your users and maintain the integrity of your platform. Could you please advise on the best way to share detailed findings with your team for immediate action?
If your organization offers a Bug Bounty program, I would appreciate information on how to participate. If not, I am committed to collaborating with you to strengthen your digital security framework.
I look forward to your prompt response.
Best regards,
Nishant Prajapati
As with all such messages they're testing to see if the address sent to is 'live', which they then take as confirmation to hit the bug bounty scam hard.
Needless to say all these types of emails can be ignored - DO NOT RESPOND, and/or if they raise concerns, consult a trusted person or support agent rather than random nobodies on the Internet.