[liquid_stranger]

Look into Zerodium https://zerodium.com/.

They sell exploits to government agencies. They are one of the more legit outfits, but researchers can also sell exploits to NSO style bad actors.

[pcthrowaway]

I know what Zerodium is, but why does security work "lead to" exploit selling? There are lots of researchers who don't do that.