I agree with you and have done so in the past. Quietly telling the developers of a website that they have large vulnerabilities that allow me to gain almost com

I agree with you and have done so in the past. Quietly telling the developers of a website that they have large vulnerabilities that allow me to gain almost complete access to large numbers of accounts. With things like that, especially when revealing it could lead to people using the vulnerability maliciously I don't think it is ethical to release details of it, unless they don't make any indication they are going to fix it. It is bothersome when they don't even thank you for bringing it to their attention however.