Hacker News Reader

What are their damages? He's not required to disclose their security vulnerabilities to them. It's his work not theirs.

I think lovasoa is pointing out what could happen in real-life, not 'what should happen morally/ethically/etc'.