Some challenges around discovering simple flaws in a Pyramid webapp