Comment by foota

While I'm not sure how keeping the bug secret compares to revealing the bug immediately in terms of ethicality, I think we can all agree that keeping it secret for a reasonable amount of time while the company fixes it (unless there is active evidence of exploitation, or you have significant reason to believe there is) is strictly more ethical than either of those options.