A well-intentioned researcher discovers a vulnerability on the web site of a major corporation.

Ignore it.

Try to sell the information to a well-paying party on the dark web.

Notify the web site owner so that corrective action be taken as soon as possible to patch the vulnerability.

Exploit the vulnerability without harming the web site owner so that attention be drawn to the problem.