This may be a community wiki, I'm not sure.
Imagine a scenario where you discover a security flaw in a company's website while browsing the web. Something involving a change to URL parameters that releases information to you that you otherwise should not have had access to, for example. By changing these fields are you guilty of "hacking"? If so, should you report the security flaw to the company, or is there a legitimate fear of legal repercussions if you admit your "guilt"?
Clarification as requested: This is all external facing, fully accessible .NET pages that accept variables that can have unintended results when modified.
Second Edit: To be clear this is not a company I work for, but another website on the internet that I have no relationship with.