its a free for all of targets known to be vulernable to javascript injection via some route or other?

And? They won’t be less vulnerable by not being listed, nor easier to find for any moderately skilled attacker (especially these days) by being listed publicly.

>And? They won’t be less vulnerable by not being listed,

Incorrect, if you find a vulnerability and make that public, and point attackers towards them, you are making it more likely they are attacked, and thus making them more vulnerable.

What? Attackers already know, most of these are stuff like XSS and WP which I assure you even over 15 years ago were easy to find en masse. Still remember old school SemperVideo, was a monthly occurrence at the time.

This is akin to saying HIBP shouldn't tell you which addresses are affected by hacks/leaks cause that points attackers in the direction. They already know and not disseminating information doesn't prevent that.

Broad generalizations being made here

>https://cogecog.com/the-threat-onion/

See the onion model. You are raising awareness of a vulnerable target. I can argue that you are increasing risk, it's a reasonable argument regardless of whether you can defend it. You are introducing a liability to yourself of being civilly liable for damages and criminally responsible, all this for no gain except some possible altruistic desire to improve security. It's a categorical error.

I find the policy of not increasing awareness to a vulnerability is more consistent with my desire to improve my personal position, I do not get involved unless there's something that benefits me. Raising awareness benefits the consumers of these websites, while damaging the owner, which may be an ethically positive action under your paradigm, but it also damages your personal position.