As I understand the hole shebang, the German law is about "does the court think you are `hacking` something?" -- this is against the law.

Yes, there was one German pentester that got sued, because he reported a BASE64 encoded, hardcoded authentication token in an application. Not that I would wish him anything like that and am ashamed by the outcome, I also recall that he might have tried to put pressure on the vendor by doing an interview with a blogger or so?

On the other hand, I do not know of any cases regarding publication of dual-use tools as OSS.