Is it acceptable to use software vulnerability for commercial gain?