The ethics are fine. The architecture is broken.

For years, the security industry has treated responsible disclosure as a moral test: are you a "good" hacker who reports the bug, or a "bad" one who exploits it?

That framing was always simplistic. In 2026, it's outright delusional.

When a white hat finds a $10M exploit and receives a $500...