[turtles]

Its straight up illegal.

What OP doesn't mention is that there are legitimate brokers. You dont have to use those shitty hackerone services.

[ryanlol]

Depends greatly on the context. Selling exploits definitely isn't "straight up illegal". Selling vulns much less so.

[turtles]

Yes, sorry, my statement was lacking context. I was referring to someone selling to a criminal organisation.

[ryanlol]

Not necessarily. Knowingly selling to someone that'll use it for a crime, probably.