In this case, I wanted to take Google up on their Vulnerability Reward Program, so I purposely went looking for security holes. I used Firebug and the Chrome inspector to search for issues.