body: Can someone who discovered a [zero-day exploit](http://en.wikipedia.org/wiki/Zero-day_%28computing%29) in a program sell the information, and does the applicable jurisdiction depend on his location, the buyer location, the location of the developed of the product that the exploit targets, or something else?
  
  
  
title: Is it legal to sell zero-day exploits?