IANAL, If you're "fully disclosing" a vulnerability in a service (that isn't running a responsible disclosure program) rather than a code-base, you're potentially opening yourself to legal trouble.

Even looking for vulnerability's in software running on servers that aren't controlled by you without permission is very legally sketchy.

Whether or not you should do so or not for the good of the internet is a different argument, but you should be aware of the potential implications.