I am inclined to agree - intent matters. RCE/SQLi, then contacting the relevant company to notify them about the problem, shouldn't be a crime. RCE/SQLi, then

I am inclined to agree - intent matters. RCE/SQLi, then contacting the relevant company to notify them about the problem, shouldn't be a crime. RCE/SQLi, then dumping all the data and exorting the company with it, should definitely be.