Comment by Thorrez

>you must disclose it responsibly.

While most people agree selling a vulnerability is immoral, there is much debate on whether "full disclosure" is ok, and whether "responsible disclosure" is a term anyone should ever say (some argue the correct term is "coordinated disclosure").

https://news.ycombinator.com/item?id=18233897