While most of me likes the idea of being paid good money for my efforts, or even for doing nothing if I can get away with it, a rather pesky part of me (a nagging entity that calls itself “a conscience”) would take all the fun out of doing it by enabling harm to others (via selling information on possible exploits, for instance).

The other blockers of course being that I have neither the skills nor the time to find such flaws in the first place!

It is true that there are people out there who do have the skills, and the time, and would be fine with selling their results to third parties, so maintainers (particularly those publishing widely used projects), would do well to treat people who practise safe disclosure with sufficient inducement to keep doing so.

meh, if you don't do it someone else will.

I prefer to judge others by standards I keep myself, rather than slipping mine towards the lowest common denominator. Both because it is morally right IMO and, I must admit, because I like feeling a little superior.

It is generally held that "Defect" is not the optimal strategy in the Prisoner's dilemma, and that seems to be what you're arguing for here, or something analagous to it.

Follow the golden rule.

Only if everyone takes that attitude.

Individual Humanism will return.

It's long overdue.

I am not 100% sure, but wouldn't that be a crime under the laws of many countries? If someone left their car unlocked with keys next to your house. Will you also steal it and sell it to somebody?

The crime here would be more along the lines of selling the information that you leave your car unlocked with the keys next to your house.