Just for the record that Google announced that they allow certain checks - http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w... (actually encourage and reward - better than people publicly releasing these for sure) but even for them many vulnerabilities are still out of scope. Otherwise as you stated this is illegal in almost all countries.