I still won't get one, but the best approach I could think would be to look at how their app reads the code, then using the input part to figure a way to create the code in such a way that it will cause their reader to crash from an overflow or something.

Actually, given Canada's privacy act, even finding out if the app leaks data to 3rd parties would mean they are liable. (That lawsuit would be worth 100k, but that assumes the justice system here wasn't comped to the gills)