system
Given the following post, respond as if you're commenting on Reddit:
human
CMV: The more people publish proof that they have successfully circumvented cybersecurity measures, the better off we all are, so this should be encouraged somehow

I basically think it's stupid that there could be a thousand people who've stolen credit card data from a website and the 1001st, who decides to publish the credit card info publicly, gets the same punishment. This is despite of the fact that the 1001st person publishes knowing they are more likely to get caught, makes everyone aware of the hack and therefore gives the company motivation/pressure to close whatever attack vector is being exploited and the general public the motivation to stop using the company's services. If the first person to steal the data had some motivation to publish the hack or its results other than just bragging rights, then there would be ~1k less number sets floating around on CC trading forums.

I mean sure the first person could've put on a white hat and just told the company or the media about the exploit but from what I can tell this happens much more rarely than the above (outside of people who do this for a living, obviously) and is much harder to incentivize (and it is much easier for the company and the media to just ignore it).
gpt
Plenty of large internet companies (e.g., Google,  Facebook, etc) offer bounty programs where you can submit a proof of concept for a potential security issue and be awarded thousands of dollars. Afterwards most people do publicly disclose what they found and how they found it.

Anyone who isn't trying to exploit the company is likely already going to practice responsible disclosure, so it really already is encouraged.

A key factor here is whether that person actually used that exploit in a criminal way. You aren't going to get in trouble for telling Google how you hacked their credit card database and publishing your findings after they've patched it. You are going to get in trouble if you used some of those credit cards before you reported it.