I've been on the side of disclosing a handful of times and it's a gamble each time whether I'm going to get a CFAA threat (both implicit and explicit threats).