How could I spot red flags?
The red flag is actually the entire red zone (like trees in the forrest...). If there is code for encryption at all, you better throw it away unless it's some proper library from a source with good reputation for exactly this kind of thing.
It is something different, if they use a cryptographic library properly, that can be achieved by non-experts. But implementation of actual encryption ... the chances of a crucial error are immense.
For example, the Standard File protocol supports E2E ...
If you look at the homepage, the section developers is only listed in the menu, there is no matching content. However, on the positive site they don't actually implement encryption, they use CryptoJS as library.
For example, is splitting a key in thirds a good idea?
In general: Actually it doesn't make any sense, because you should create keys fitting to their task and why would someoen want to split a key in a meaningless way? If the goal was to split it securely in the sense of a secret sharing scheme (e.g. that you can only reassemble any information with both halves), that's something totally different.
Telegram did this with a $300k bounty.
The Telegram "challenge" is bogus anyway. It is basically "I think of a number, give you no information, and if you can guess it, you win".
That is not how cryptanalysis works, that is not how security works. By doing that, they already proved that they don't understand much about these fields.
Here are a few articles about that: