This is my position as well. History is replete with examples of people being punished harshly for reporting security problems. In the Randal Schwartz case, dis

This is my position as well. History is replete with examples of people being punished harshly for reporting security problems. In the Randal Schwartz case, discussed in a link above, he was working for Intel and doing routine best practices security testing there that got him arrested and convicted. So even if you are working with complete authorization, if you have political enemies or just clueless people around, they can make the argument that you are the bad guy. So stay quiet and let the real bad guys figure it out. There are also many who make reasonable incomes selling exploits on the black market.