So people just have to feel 'safe and in control,' rather than making sure they are actually safe and/or in control? It sounds like an admission that the whole anonymity thing is just a marketing gimmick: as long as you have a name like "Secret" and make people feel like they're safe, they'll share whether or not they have strong security at all.
Post Snowden, there's an obvious market for "secure" and "anonymous" apps and startups, and the appearance of security is usually cheaper, quicker to implement and less annoying for end users than the real thing.
Having a bug bounty is nice and obviously security is hard even when you do try, but even that can be used to give the appearance about being aggressive about security while still making sure their network is just broken enough to return whatever value there is in being 'social' (which is usually antithetical to being secure or anonymous.)
"Social Network A wants users to feel like they control their privacy settings."
"Online Store B believes shoppers should feel like their credit card information is secure."
"Cable Company C's service goal is for customers to feel like their support issues are being addressed."
But more seriously, if there are bugs that can reveal the poster's identify in the first place, then it's not anonymous. It's very easy to make your servers not record any identifying information along with the text or pic. It's also easily possible to strip any exif data from an image. Clearly for usefulness/monetary value, the identity of the poster is being recorded.
Before you even sign up it's quite clear that there can't be anything anonymous about this at all. It delivers plausible-deniability at best.
Their claims may be fuzzy. People may not be paying too much attention when they sign-up or use it. But they're quite clearly not trying to make an actually anonymous secret sharing site.