I don't know about the "sell the information on the blackmarket" part. But uninvited pen-testing seems pretty risky. Maybe it'd be prudent to have an ~anonymous

I don't know about the "sell the information on the blackmarket" part. But uninvited pen-testing seems pretty risky. Maybe it'd be prudent to have an ~anonymous pseudonym for this stuff. And if you really care about reputation building, you could use an ~anonymous pseudonym plus the sha256 or sha512 hash of some string. If it all works out, you just share the string, and reap the credit.