1) You're not using the HTTPS protocol! What does this mean? Well, anyone can access your account on the website.

If you're using the registration provided by the website (not steam or any other 3rd party service), then people can find out the password that you're using, and if you use it for other sites... Well yeah...

I think (knowing how oAuth and other protocols work, and this http://i.stack.imgur.com/8KjWN.png), you'll have a token stored client side (which is logical, usually). However, this token is most likely passed to flarum first, which then passes it onto facebook, meaning that again, people can access your account *on this site, not on the 3rd party*, for a limited time.

Depending on what permissions DH (well, flarum) requests from your facebook account, it may also be possible to "persuade" flarum to interface with facebook to do actions which you didn't intend.
> _Can be corrected with Let's Encrypt certificates_

2) People can request for a password reset, intercept the email, and read it because DH send it unencrypted.

What does this mean for you? Well, anyone can access your account if you use the registration provided by flarum (the forum software)
> _Can be corrected with Let's Encrypt certificates_

3) You're using a beta software not recommended for production. This means there's likely to be security flaws within the software itself, and may or may not mean that your account can be compromised.
> _Can be corrected by changing forum software_

4) Your donation store isn't encrypted. You process contact details of the user, and are not encrypting them. Despite this, you don't process any direct payment information (such as card numbers, CCVs, expiry dates, etc).
> _Can be corrected with Let's Encrypt certificates_

5) You use cookies and also collect user data, but don't provide a privacy policy, nor a cookie policy (on your donation page too)
Because you're not encrypting this data as far as I can tell, you need to tell people this in a privacy policy, so that they know their personal information is potentially at risk.
> _Can be corrected with a Privacy and Cookie policy_