Substitute “exploit” for “speech about security” and you will see that doing so is explicitly protected under US law.