Comment by vividmind

I think it has to do with intentions. Not trying to literally map online site to a house. But in general, when a person has found a vulnerability and is trying to report it in a good will (no matter through what channel), as opposed to using it to try and blackmail, etc., things should not be reversed and used against that person.