Zero-Day Exploit Sales

Because you're missing the other half of the exploit market: Selling vulnerabilities for big cheques.https://zerodium.com/program.html

You realize you could be monetizing these security vulnerabilities, right?

Bounties are one thing but how about selling exploits to organizations like zerodium? Since you won't disclose,won't they pay a lot better?

You can sell it to others. Zerodium buys 0days for 10 times or more than the original bounties.https://zerodium.com/program.html

This answer depends on your ethics and the nature of the security vulnerability you've discovered. I'm going to leave out web application vulnerabilities, because the vulnerability half-life, method of discovery and supply/demand on those is entirely different. For those, check out bug bounties. Let's go over your options:1. Responsible Disclosure:Do you have a privilege escalation, sandbox escape, remote code execution, etc. vulnerability in a major browser (Int

They making a explicit decision to reap a larger payday by selling the exploits to governments or other companies rather than disclosing it to the original application authors for the standard bug reward.The sellers have no way of determining how the exploits will be used. The mere fact that buyers are willing to spend so much on an exploit indicates they are not just collecting them out of idle curiosity. Even we could completely trust the buyers to not misuse or share information about the

I mean you just search on google... Zerodium, Crowdfense, Exodus Intelligence, etc.Sure, I'd say the "sell it elsewhere" stuff is always a bit overly optimistic but due to the nature of this specific exploit I am pretty sure you could find a buyer offering good compensation.

How much would that exploit be worth on the open market?

>avoids the urge to go to the black market (or NSA, etc).You can still sell your exploit to the black(site) market and later collect a bounty on it. You take some risk that someone else finds it or the party you sold it to leaks it.Price accordingly.

nice man...you know that you can basicly sell exploits like that on the darkweb -after they are patched....-no one can steal the money but peaple will buy the exploits......