Explore vulnerabilities and insecure software of a regional carsharing provider in this semi-humorous conference talk. Dive into a colorful coral reef of weaknesses, discovering how to navigate through information disclosure and overly informative APIs. Learn about web application vulnerabilities and insecure design while following the journey of uncovering security flaws, creating a treasure map for future explorers through responsible disclosure to CERT Bund. Prepare for a wild ride as the speaker presents lessons learned about web application security on these bumpy roads of digital exploration.