Actual example from my experience: Trying to figure out the correct AD groups/permissions I needed to use an internal web app to schedule patching for some ser

Actual example from my experience: Trying to figure out the correct AD groups/permissions I needed to use an internal web app to schedule patching for some servers I managed. After stepping through the app's js, I realized they were doing user group retrieval and validaton client-side (!!). Wrote a quick POC that patched their check and gave me admin permissions, then sent it and a description over to a friend on the internal app security team. Not my job, but apparently the service account backing that app had permissions to reschedule patches on any internal server. (including f.ex. domain controllers) So probably something that it was worth having someone spend a couple hours figuring out and reporting, despite it not showing up in my OKRs.