I think the best solution would be for more companies to publish a page on their website telling people what to do if they find a security problem, like GitHub and 37signals do (Google and Facebook also offer a bounty).

I guess a problem with this is stating where the line is drawn. It might be difficult to promise not to sue well-intentioned researchers without reducing their ability to sue people with malicious intentions.