I specified "moral" because most bug bounty programs' terms have a blanket prohibition against public disclosure (at least until vulnerability is resolved), and in some cases public disclosure could be legally ambiguous as well (because CFAA is so vague and broad).