> If I find a bug on my own I can do as I please with it.

only if your access to the vendor's systems wasn't precluded with an eula that you agreed to beforehand. I don't see company be stupid enough to not put in broad legal terms in the eula to prohibit this sort of penetration.

But if you weren't given permission first (which may involve said eula) then that must mean you're accessing without permission - which is illegal.