Why publishing exploit code is generally a bad idea if you're paid to protect (cgisecurity.com)