A well-intentioned researcher discovers a vulnerability on the web site of a major corporation. What should he do?

Selling vulnerability information on the dark web is illegal and unethical, constituting active participation in cybercrime markets regardless of the seller's original intent.

Exploiting a vulnerability without authorization is illegal under laws such as the CFAA even when harm is not intended, and it does not guarantee the owner will be alerted or will act.

Ignoring a known vulnerability leaves users and the organization exposed to exploitation by malicious actors, which is an irresponsible and harmful outcome.

Notifying the web site owner follows the principle of responsible (coordinated) vulnerability disclosure, which gives the organization time to remediate the issue before it is publicly known or exploited by malicious actors. This ethical approach protects end users, preserves trust, and is the standard expected behavior in the security research community as outlined by organizations such as CISA and ISO 29147.