In high school I reverse engineered my school grading system portal (Skyward) and made an app to help me prioritize assignments by their impact on my GPA. In the process I found that there were almost no permissions enforced. I made a typo in my user id number in a python test script and boom there was someone else's transcript! I set up a meeting with my principal and after much shade being thrown by the school district I proved to them it was a legit issue.