Spearphishing is a real problem and tech companies have no answer. An annual employee training program isn't going to solve the problem. Simply making it illegal isn't going to solve the problem.
That's why we have responsible disclosure. It does not make it okay to exploit security holes for profit.
> Spearphishing is a real problem and tech companies have no answer.
That does not make it okay to exploit it.
I'm not aware of any bug-bounty or responsible disclosure method that allows spear-phishing as the attack requires impersonation/fraud. Is there one?
The responsible way to do this would be to prove the access to twitters security team and not exploit it for personal gain. You can even just post it publicly, just don't try to scam people and profit based on the exploit.
Do you think that just because there isn't a bug bounty for a specific exploit that gives you a free pass to exploit it for personal gain?
There are at least two or three levels of this where any reasonable person would have thought "This is getting really fucking criminal"