I report all the glitches once I've confirmed them, and also report and incinerate any possible benefit I've gotten from them. Also, I don't test them further after they're reported. My intent is to get these fixed, and I really don't like security through obscurity. It's better for the community to let me find the glitches and get them patched soon than if someone with the intent of abusing them finds them.