I spent a week auditing one of my Symfony projects with the same tools as in CTF: Burp Suite, OWASP ZAP, manual code review.
What I found
1. IDOR on an API endpoint (sequential IDs)
2. Missing security headers (CSP, HSTS)
3. Verbose error messages in production
4. Session token not regenerated after login
5. No rate limiting on contact form
6. Dependencies with known CVEs
7. Information disclosure via X-Powered-By
What it taught me
None of these vulnerabilities is "advanced." All are documented in the OWASP Top 10. Confidence in your own code is security's worst enemy.