A well-intentioned researcher discovers a vulnerability on the web site of a major corporation. What should he do?

Selling vulnerability data on the dark web is illegal under computer fraud and cybercrime statutes in most jurisdictions and directly enables malicious exploitation of the flaw.

Exploiting a vulnerability on systems you do not own constitutes unauthorized access regardless of intent, violating laws such as the US Computer Fraud and Abuse Act and equivalent statutes globally.

Ignoring a known vulnerability leaves affected users exposed to potential exploitation by malicious actors who may independently discover the same flaw.

Coordinated (responsible) disclosure is the industry-standard ethical practice where the finder privately notifies the vendor or site owner, provides details needed to reproduce and fix the issue, and allows a reasonable remediation window before any public announcement. This protects end users while ensuring the vulnerability is eventually resolved, and is recognized by frameworks such as ISO/IEC 29147.