Funny,

I was nearly expelled from my high school for finding and immediately reporting a vulnerability, without having actually exploited it. Also my story is far too common. Most of the people in charge don't know anything!

Many of us in the industry who have been around the block a few times support either selling your exploits or open disclosure. We have our reasons.