Respond to a security vulnerability report from an outside researcher

Help me respond to a security vulnerability report about my SaaS product. The report: [PASTE IT, removing any customer data or secrets] How it arrived: [security@ email, bug bounty platform, social media, support ticket] Our disclosure policy or bounty program: [LINK or "none"] Affected component and stack: [DETAILS] What we've verified so far: [reproduced / not yet / could not reproduce] Give me: 1. A triage checklist: reproduce safely in a non-production environment; confirm scope (which tenants, data, versions); check logs for signs of exploitation; decide whether customer data was accessed. 2. A severity rating using CVSS-style factors (attack vector, privileges needed, user interaction, impact on confidentiality, integrity, availability), plus SaaS-specific factors like cross-tenant access. State what would change the rating. 3. Response timeline: acknowledge, triage update, fix, verify, disclose. Give target times for each by severity. 4. Draft replies to the researcher: acknowledgment within 1 business day, a status update, and a resolution note with credit if they want it. Polite, no threats, no promises of payment we haven't agreed to. 5. How to handle common situations: duplicates, out-of-scope or low-value reports (missing headers, self-XSS), researchers demanding payment, and public disclosure pressure. 6. When this becomes a security incident: if exploitation or data access is possible, switch to incident response and assess customer and regulatory notification duties with legal counsel. 7. A short responsible disclosure policy I can publish if I don't have one (scope, safe harbor, how to report, what we commit to). Do not run or suggest testing against production customer data.