2022 DOJ guidance is relevant here:

  The policy for the first time directs that good-faith security research should not be charged. Good faith security research means accessing a computer solely for purposes of good-faith testing, investigation, and/or correction of a security flaw or vulnerability, where such activity is carried out in a manner designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the class of devices, machines, or online services to which the accessed computer belongs, or those who use such devices, machines, or online services. 

Having been threatened with CFAA charges for using wget to get FOIA files on S3 whose URLs were embedded in the page's source, it's refreshing that intent is at least a small factor. But as with criminal courts, charges alone can absolutely uproot someone's life.

https://www.justice.gov/archives/opa/pr/department-justice-a...