Lots of constructive things I want to point out. Don't think I'm bashing on the idea... (But you did post it as a Show HN so like most hackers I tried and find out how things work).
- I successfully created an account without paying. (Contact me through my email if you want details. You can find it in my profile).
- You write all of your clients details to disk. I can view them all here. http://learnmoreabout.it/ I can also overwrite other peoples tests. (Not sure if you are aware of this). (Could also be used as a very easy denial of service vector killing available inodes)
- Being able to access stuff like this is wrong. http://learnmoreabout.it/usr/share/base-passwd/group.master
- You have an active RAM disk which is readable through HTTP. I've been able to download and mount and read from it.
- You've got an SQL injectable page. (Took a while to find one, but it's there)
- You are doing validation that should be done on the server, via the client. (ie. Checking that the name doesn't contain invalid character.). So this ends up with people writing to directories they shouldn't. See the file directory 'thisShouldNotBeHere' within your web accessible /usr directory? http://learnmoreabout.it/usr/share/mysql-common/
I've uncovered way more information than I ever should have been able to (it was almost as fun as the Strip CTF). If you want any advice, I'm always infront of an email client... (and PHP is my main language)
You are definitely at a very early MVP stage, but already I'm reminded of this blog post from last week: http://blog.ryankearney.com/2012/10/never-give-your-informat...
And, in case anyone says I should have followed responsible disclosure, I prescribe to the same ideals as Silhouette in this comment. http://news.ycombinator.com/item?id=4619657