> IT security is pretty catastrophic (German law makes it hard to do it properly, it's much stricter than e.g. the corresponding US law)

To chime in on this, if you're in Germany and report a security vulnerability to a vendor there's a very good chance you'll get a criminal investigation, house searched, computers/phones seized for a long time etc. in return. Often in combination with a cease and desist or civil charges.

It's not a good idea to approach vendors directly with findings in general, but in Germany doing that can seriously screw your life up.

I wouldn't do security research in Germany at all. If you have talents in the area, just go to the US.