> At which point does it become illegal though? Is it considered insider trading if you know about a security issue but have no internal knowledge about deals e

> At which point does it become illegal though? Is it considered insider trading if you know about a security issue but have no internal knowledge about deals etc.? Trading on a security vulnerability that has not been made public is, on a basic level, not insider trading. Contrary to popular belief, there is nothing illegal about trading on material, nonpublic data. Insider trading requires the trader to have a confidentiality agreement governing the data with the company, or to have a fiduciary duty to shareholders of the company. There are basically two situations in which trading on the vulnerability would be illegal insider trading: 1. You work for the company, or are a consultant engaged by the company, and you have knowledge of the vulnerability, or 2. You report the vulnerability to the company as an outsider and, in the process, enter into a confidentiality agreement. Regarding scenario 2, merely reporting a vulnerability wouldn’t cut it. If you report the vulnerability through a channel that requires you to accept a confidentiality agreement as part of the terms and conditions of reporting (such as a bug bounty platform, like Hackerone or BugCrowd), then you can’t trade on it. On the other hand, if you report the vulnerability through a channel with no constraints, such as to a security@ email address, you have no confidentiality agreement.