As a hobby, I find security holes ranging from XSS to SQLi to LFI etc in random websites I find. (I don't exploit them). I've decided to to do a little more; I want to create a volunteer group composed of hackers who will find holes and report them to the website.
I'm finding two "issues":
- Although I don't exploit the holes, could I get in legal trouble for reporting the hole to the website?
- Where could I find fellow non-malicious hackers?
The group would be entirely volunteer based and would be completely non-malicious.We would not take on clients or do tests on request. Sites would be entirely random; no specific sites would be targeted and the test would be conducted without the site's consent or knowledge. If a hole is found, the site is notified. If not, we would move on.
Should I be concerned about anything else?
I apologize if this is the wrong site to ask, but I have no idea where to go...