pro tip: don't even look at the website until "code freeze" day, then submit all findings via instant message.