I think there is a difference between identifying an exploit exists and making a tool that makes it easy for anyone to exploit. I think if you are releasing a tool to act on security vulnerabilities it should be done so very carefully so that it can't be easily used to commit crime.