Is it not morally wrong as a non-black hat to not inform a company about a vulnerability you've found?

I thought only black hats sat on exploits.