ethics regarding discovering vulnerability in competitor web application

You could write it up, tell the competitor and then after a set period of time publish the write up as a blogpost.

Not telling them can potentially damage them and their clients, which isn't something you want to do.

I discovered a similar hole in the website of a major Irish company about 15 months ago.

My options, as I saw them then:

1. Demand a reward in return for the vulnerability, or I go to the press and the data protection commissioner.
2. Tell them and ask for a reward.

The first option might have gotten their backs up and they might have gone legal, claiming extortion and I could have ended up being questioned by the police or defending a civil circuit / high court action. I am not a pen tester looking to build a reputation and the publicity could have been very negative for me, plus a relative was working for them in a fairly senior position and LinkedIn would have revealed this quite quickly. I ended up going for the second option and they did give me a nice piece of electronics along with their genuine thanks from the senior management team.

A third option I didn't know about at the time was the existence of third party 'exploit brokers' who make the approach for you and demand a price for revealing the flaw - this would have shielded me from the publicity and I would be sorely tempted if put back in that position again. €10k would not have been unreasonable considering they would have probably paid more than this to a PR firm for damage limitation, let alone the lost business and damage to the brand.

I was not working for a competitor so I didn't have that ethical consideration.

Karma exists - I now work for them indirectly as a contractor sitting on one of their offices every day - they are unaware I am 'that guy' though but imagine if I had gone for the first option.