> give them an option to pay a consulting fee for the discovery in exchange for NOT publishing the exploit (after it has been fixed) I'm not making any moral j

> give them an option to pay a consulting fee for the discovery in exchange for NOT publishing the exploit (after it has been fixed) I'm not making any moral judgments, but purely from a legal perspective this sounds dangerously like blackmail. If anyone decides to take this path, be sure you understand the risks involved.