Without wishing to appear overly snippy, this is how I would begin hacking such a site.

Offer to do a "code review".

I got an offer of a "code review" like that once for an authentication system and never heard back; it was open source anyway so anybody could have downloaded it and found my rookie mistakes like

  signed_token = content + MD5(secret_key+content)

which doesn't stop anyone from appending to the content (might not have really been exploitable, but any honest review from somebody who knew more than me would have turned it up)

> Without wishing to appear overly snippy

You failed.

"Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."

https://news.ycombinator.com/newsguidelines.html