The legal line is prior authorization, not intent. Bug bounties and coordinated disclosure grants exist precisely because good faith alone does not protect you; prosecutors treat unauthorized access the same whether you call yourself helpful or not. Givebacksies are mitigation at sentencing, not a defense.