Because I don't know how it was intended to be used. Just because you can do something doesn't mean you are legally allowed to. People have been prosecuted for

Because I don't know how it was intended to be used. Just because you can do something doesn't mean you are legally allowed to. People have been prosecuted for simply opening URLs without any authentication, and I know the specifics of that case were different, but it still terrifies me that I might accidentally trigger a bug in a system that looks "intended" to me, but to them looks like a malicious attack. And once they have decided it's against their intention, i'm in the wrong. There's no way for me to easily or quickly "prove" my intentions were pure or my understanding was incorrect, and even if I could it's still months or years of litigation possibly with me in jail. And all of this goes doubly for trying to be a whitehat and letting the government know about vulnerabilities. Saying "hey I found this vuln in your system" is pretty much a confession that I did break the law and used a computer system illegally.