Code made during a hackathon has no values. It should be redone. You can’t go very far using such codebase. It’s always full of hacks and undocumented shady functions (and MySQL triggers, for sure haha). So, no, they weren’t exploited by this guy. He tried to exploit them, and failed, because he doesn’t know that what he has in his hands is a glorified Rube Goldberg machine.