And also don't follow up a disclosure with an offer to sell exploits to the highest bidder.

Is selling an exploit to a foreign government even 100% legal? (Serious question; that seems like the sort of thing that could get one in trouble.)