I'm not a lawyer so I'm not speaking to the legality of this. Legality is not the only thing that matters. If you publish an exploit without at least making an

I'm not a lawyer so I'm not speaking to the legality of this. Legality is not the only thing that matters. If you publish an exploit without at least making an attempt to fix it, and someone follows you and exploits it, then there's a direct moral line between you and that exploitation. They more likely than not wouldn't have exploited it without you putting that published info in their path. It's now on you, them and the company, morally. Any damages that result from this interaction are because you and the company enabled them to happen. That's different to someone else stumbling on it and exploiting it. That's purely on the company and the exploiter.