Not just reporting it, but having actually exploited it to confirm before reporting it, even if just to test. That was the wrong move. What should have been do

Not just reporting it, but having actually exploited it to confirm before reporting it, even if just to test. That was the wrong move. What should have been done was the second he had the thought that such a vulnerability could exist, he should have notified them that he believes that there is a possibility for one to alter the site code locally to gain unfair pricing, and to ask them if either he could check for them or if they could check using his proposed method. The second you actually test without permission, you've committed a crime. Jury/court might look at intent later on, but for now, you've committed a crime and are thus subject to arrest.