Apologies if this is not the right place to ask this question, I will happily move it to another Stack Exchange site if need be.
Before I explain the rationale behind the question, let me clear up a few things first.
- I enjoy cracking software, for my own educational purposes.
- I do not participate or work for any cracking group.
- I never release or publicize any cracks/keygens and do not use them for personal gain.
- I attempt to protect my own software better based on flaws I discover in other people's software.
- I am a software vendor myself and would hate for my work to be pirated, so I gladly pay for licenses and would appreciate if anyone ever approached me and pointed out flaws in my software.
With that out of the way, my question is, if I am able to successfully crack a piece of software (games, components, etc.) should I notify the vendor that their software is vulnerable, or just keep it to myself?
I have notified a few people/companies (usually small time developers) in the past of which all appreciated the feedback and subsequently strengthened their license checking as a result. Should I be doing this on a regular basis or can I get into serious trouble for even attempting to reverse engineer something? I don't charge or try blackmail people either, totally above board with full disclosure.
My own EULA states "Redistribution of source code is strictly prohibited by means of reverse engineering or otherwise" which clearly highlights redistribution, not personal gain or even self improvement (no idea, I'm not a lawyer).
This moral dilemma has bugged me for quite sometime and I would love to report back to vendors so that they can avoid being compromised. Not sure if everyone will be forthcoming about it and may even be offended.