Having worked for a public school district, it is my experience that things almost never go down as parent said. What actually happens is that they get caught and make an excuse (I was about to report it!) or their "report" of the problem is in the form of some leet-speak shit-talk on a public message board. A common theme you'll notice when people describe these events, even from their own perspective, is how they absolutely did change something, deface the page, etc.
School (the institution) is not about learning. School (the institution) is about conformity. And finding exploits is anything BUT conformity.
It should be about learning. I think finding exploits should be encouraged and rewarded.
Agreed.
Perhaps in some places, but not everywhere.
I got in-school suspension for the last 1/3 of senior year in HS because I took screenshots of a shared network directory permissions problem.
Me too, but unfortunately it's standard idiocy both in schools and in large companies. Whether you're a curious student or a white-hat pentester, it's still the case that if you find something and say something, you're treated as if you were the danger.