There's also at least one grey hat (reddit user u/neo_truths) who's been able to get into Neopets' databases and expose how broken the site is and how much cheating runs rampant... real interesting stuff.
EDIT: Here's a fun example. Ancient bug where items above a certain rarity level weren't available in NPC shops, despite Neopets' staff insisting that they were... turns out r100s were in fact buyable, but not visible, so the only way to snag one was to figure out the exact URL for the item as it was generated.
https://www.reddit.com/r/neopets/comments/npzffe/restocking_...
https://www.reddit.com/r/neopets/comments/nu4k5o/r100_restoc...
Edit: looks like others in this post had similar experiences :)
It was a bit nostalgic for me since I originally learned HTML/CSS from Neopets over a decade back
Within 30 minutes I discovered you could create any Neopet, including the limited edition ones like Jetsam, just by setting that name in the API call