Been there, made this mistake. Recently pursued an SF-85 public trust for work and under the "have you ever accessed or attempted to access a computer system without prior authorization" question I detailed at length my exploratory research into penetration testing, including how I discovered (and reported) that a school computer system had _domain admin_ credentials of admin:password, among other privilege escalation bugs I had found and reported.

Yeah, that did _not_ get approved.