[markeganfuller]

Sounds like it would be a good extension to Data Protection / Computer Abuse/Misuse Acts depending on what it allows access to. Anyone pointing out a failing in your system should not be prosecuted unless they've actually committed a crime.

[mdpopescu]

That doesn't actually help; you need to think more like a prosecutor. By investigating the vulnerability they have, in fact, committed a crime - see for example http://blog.erratasec.com/2013/09/how-weevs-prosecutors-are-...