Without wishing to appear overly snippy, this is how I would begin hacking such a site.
Offer to do a "code review".
Offer to do a "code review".
signed_token = content + MD5(secret_key+content)
which doesn't stop anyone from appending to the content (might not have really been exploitable, but any honest review from somebody who knew more than me would have turned it up)You failed.