As someone who was bitten by the CFAA before, you are 100% correct in being concerned.

If you're going to test, do it anonymously.

If you find anything, don't report it.

Anonymity and good OpSec are the only things that can guarantee to keep American hackers out of prison.