Amusingly, I had almost this exact experience in middle school. I'd figured out that the barcodes used on our school lunch cards were just plaintext for our ID

Amusingly, I had almost this exact experience in middle school. I'd figured out that the barcodes used on our school lunch cards were just plaintext for our ID numbers. With minor cooperation from a nice lunchlady, I discovered that there were a couple very low numbers (e.g. 00000001) that had effectively infinite funds. Presumably they had been used for testing or something. I brought this to the attention of the schools tech guy, who thought it was very cool and said he'd go tell the administration so he could get permission to fix the issue. Of course, being a middle schooler with access to a card printer, I also took this opportunity to reprint my lunch card with an identical design and barcode... And a Chuck Norris photo. The administration asked to speak to me and I assumed I'd be thanked for finding an easy vulnerability that could have been losing them funds. Instead I was told I would be expelled or at the very least suspended for a month, and that they thought this constituted a felony and identity theft. Ridiculousness of those claims aside... I ended up getting a away with weekend detention after my parents and the tech guy stood up for me.