right on Spot, but also brings an ethical question ! lets say you identified an vulnerability or an hack or found something that will nullify a product's security. what would be the first step one should do?

1). send it to apple(or respective company) and if they don't respond after followups, put it on internet 2) put it on internet so it gains popularity and makes the aforesaid companies do something!

in some cases like these (those require physical access) this is fine, but what if someone uncovers a potential remote hack for every android or apple phone out there! which option would be ethical?