A well-intentioned researcher discovers a vulnerability on the web site of a major corporation. What should he do?

Ignoring the vulnerability leaves it unpatched and exposes the organization's users to ongoing risk, which is an ethically negligent course of action.

Selling vulnerability information on the dark web is illegal under cybercrime statutes, constitutes trafficking in sensitive exploit data, and directly harms the affected organization and its users.

Responsible disclosure (also called coordinated disclosure) is the ethical and legally sound practice of privately reporting a discovered vulnerability to the affected organization. This allows the owner to develop and deploy a patch before malicious actors can exploit it. It is the universally accepted standard in the security research community and protects both the researcher and the public.

Exploiting a vulnerability without permission constitutes unauthorized access, which is illegal under laws such as the Computer Fraud and Abuse Act (CFAA) regardless of the researcher's stated intent or claimed lack of harm.