What are the legal issues about finding zero-day vulnerabilities (i.e. previously unknown vulnerabilities in a program/website) and what is the standard legal practices before trying to find them if myself and the web app is being run in the legal jurisdiction of England?
As an example, I haven't tried exploiting anything yet, however, I think I've found something vulnerable in a web app. I want to try an exploit it and hopefully get a CVE but I'm not sure how to go about doing this legally.
Should I go ahead and try exploiting it, and even though I'm looking to help identify a vulnerability and disclose it to the company, should I use a VPN/Tor?
Should I contact the company and explain that I think I may have found something vulnerable and go ahead straight away or wait for their response to allow me to?