“They don't attack any systems, whether don't have explicit permission, and they always report their findings, to the vendor with plenty of lead time to have to perform a fix before they would publish their results to the wider community.”

Transcript evidence from Daniel Ramsbrock -- Web Application Pen Testing – Part 1.