Have you ever heard of a thing called the &quot;Computer Fraud and Abuse Act&quot;? Even the act of disclosing a vulnerability to the company itself can be misconstrued by paranoid big corps as a &quot;security breach&quot;, hence the possibility of a 30 years sentence. I&#x27;m just saying it&#x27;s not worth the risk. At least not in the US.