Ask HN: Are those “bug bounty” emails legit?

The startup I work for just officially launched a few days ago and we are already got two emails from "security researchers" telling us they found a security vulnerability in our website and asking us if we offer a bug bounty reward (we can't afford one right now).

Here's one of the emails:

  Hi,
  
  I just found a Vulnerability in Website can I report it here? 
  Do you have Bug bounty/reward program for reporting Bugs?
  
  Thanks and Regards

Are those emails legit? Are those researchers just sending emails new startups to build a list of those which do offer bounties? I find it improbable that a researcher would have had time to find a serious security vulnerability in our website in such a short amount of time but I obviously can't completely exclude that possibility.

Should I reply to the email? Just ignore it?