There are quite intense requirements to sell to the govt in the general case. It's unlikely anyone can just decide to sell to the federals (what's your duns num

There are quite intense requirements to sell to the govt in the general case. It's unlikely anyone can just decide to sell to the federals (what's your duns number?). One of the evergreen complaints against the USG is that contracting is rigged and stacked against SMBs because of the compliance overhead. In the specific case, it's unlikely to be illegal to sell, however it would generally be illegal for the g-men to buy. With the exception of certain intelligence community members. And even then within say e.g. the Army. The Cyber component likely could buy your zero-day, but Human Resources Command or Recruiting Command absolutely could not. And even then, say you do sell your sweet, exquisite zero-day rce to the correct part of the CIA: there's a legally mandated Vulnerability Disclosure Process that if your shit is so good it will foreseeably cause the next NotPetya then the vuln will be responsibly disclosed in any event. Edit: if you are interested in top cover for your dalliances, here is an exemplar job listing from LockMart https://www.lockheedmartinjobs.com/job/hanover/reverse-engineer-vulnerability-researcher/694/61899568784 https://www.lockheedmartinjobs.com/job/hanover/reverse-engin...