I'd be really interested in contributing but I'd hate to be contributing and then find out that this non-profit is actually some rich persons tax avoidance scheme or can be pivoted in a way to make money for someone.
Having the source code licensed as GPL or something would make this a smaller concern for me.
Please dont hire this person no matter how much they ask you to. The amount of soap operaish drama they are creating here in public even before applying or contacting in private, tells you how they will fare once they are hired.
It is easy enough to have a volunteering agreement that catches this with clauses. Open sourcing the code won’t help with that scenario anyway.
Open source what, exactly? You point makes literally zero sense
Security is security, how you get there is entirely up to your organization. Also I'm not sure how having code access to their site proves that it isn't some rich person's tax avoidance scheme. In a way, all charities allow rich people to avoid paying taxes to some degree.
Volunteer-run tech and IT for non-profits aren't exactly well known for the highest of standards of engineering. The likelihood of someone accidentally leaking AWS creds or other PII seems reasonably possible without well established engineering practices.
Alternatively, it may involve proprietary code for a software vendor they work with that they don't have the rights to redistribute.