Surely selling to a government is at least grey hat? In my book, white hat never does offense. If you&#x27;re creating an exploit that isn&#x27;t proof of concept and that harms someone, you&#x27;re not white hat anymore.