This talk walks through how a CTF mindset can translate directly to real-world vulnerability research. Starting with a closed-source AI hosting platform, using a framework endpoint to leak source code, then pivoted into classic web application testing: broken access controls, IDORs, information disclosure, and improper error handling. Within six hours, I had four CVEs filed. The vulnerabilities weren't novel. The approach wasn't complicated. It was the same enumeration, threat modeling, and exploit chaining that wins CTF competitions, and to top it off, this occurred during a CTF.