I've seen SQL injection and leaked API tokens to all visitors of a website :)