CFAA would apply only if the bug involved unauthorized access to the company’s servers (The violation being the researcher accessing them to validate). The zer

CFAA would apply only if the bug involved unauthorized access to the company’s servers (The violation being the researcher accessing them to validate). The zero days you refer to would instead be vulnerabilities in software which a researcher would test against local software / hardware they own, not only for legal reasons, but also because actively probing a web server can set off alarm bells (Making access less useful after validation).