How do you know that you&#x27;re only going to time out the backend without entirely crashing it, without actually attempting it? It&#x27;s a kinda Schrödinger&#x27;s cat scenario.<p>It&#x27;s all good and well saying that you had good intentions, but if you can&#x27;t prove it, and they didn&#x27;t invite you to test it (via a responsible disclosure policy), then I would steer clear.<p>While I wouldn&#x27;t personally attempt to prosecute anyone for responsibly disclosing a bug to me, it doesn&#x27;t meant to say that BigCorp™ wouldn&#x27;t.