Best thing ever: discovering an exploit that no one else has found (so far as you know).
Worst thing ever: being exploited.
Runner up: Learning about a beautiful exploit AFTER the company has implemented measures to stop it.
I was recently exposed to an excellent blog post about an exploit of the Kindle Unlimited system. For those