I don&#x27;t know cryptocat or its authors, so I have no idea why you consider them immoral. What&#x27;s the story?<p>Obligations are a two-way street, and good ethics should have support. If you have the means to reward disclosure of a vuln you should announce a bug bounty.<p>Professions have ethical standards. Some are stronger than others. They are meant to impose a basic level of morality. In the real world, that never happens perfectly. But some of them definitely imply disclosing one&#x27;s work without extracting every last penny from it, such as disclosing abandoned clinical trials.