Your worldview is that because there are bad actors like Hacking Team, anyone who does vulnerability research is obligated to disclose their findings to vendors?<p>No. Vulnerabilities exist because vendors ship bad code, not because researchers read that bad code. I refuse to sign on to an &quot;ethic&quot; that entitles negligent vendors to the work product of researchers.<p>You do the work, you choose what to do with the vulnerabilities. There are packages --- Cryptocat is a great example --- where I&#x27;ve found grave vulnerabilities, disclosed <i>that I found them</i>, but refused to divulge details. I would personally never sell a vulnerability; I think vulnerability markets are immoral. But I don&#x27;t get to impose that morality on others. Would that I could! I think Cryptocat is immoral, too! But I have to live and work in a world where not everyone agrees with me.<p>The one common denominator we can all share is &quot;nobody is entitled to appropriate my work from me without my consent&quot;.