- out of bounds read of argv

- shell injection from bad urls

- leaks memory

- hard coded, published api token (hidden behind scrolling to the right)

- 60 FPS render loop for static content (hi claude code)

- worst of all, not actually funny.

But the last one is hard to judge without posting and seeing the response, live and learn!