If you were a kid in the 90s, you probably remember Neopets.com, with its flash games, wheels of fortune, custom HTML in user shops, virtual pets and paintbrushes. What you may not realize is that this site is still up and running. The website is, in many ways, frozen in time. As new features have been added over the past 25 years, older code was often left intact, creating a unique historical artifact of web application development and application security. Even old accounts are recoverable, with a little help from the support team. Security has been retrofitted, engineered and pasted onto foundations that it was never intended to support. But this isn’t unique to old games, legacy software holds up the world’s banking, transport, logistics, government systems, where a breach means more than stolen map pieces.