For example, questions like "how do I tell if this crash is a buffer overflow?" or "what is a good way of exploiting heap overflows?" Basically, I want to know if this community is more focused on just analyzing code or can we also discuss exploiting code flaws.
I think as long as you keep it to more or less concrete questions, but without it being too localized (i.e. phrase them so that the answers may be applicable to other situations), both types of questions are fine. Exploiting software does involve RE, even though I feel that many exploit writers are not very well versed in the RE part.
I think the answer is yes for the first and no for the second.
“How do I tell if this crash is a buffer overflow?” Yes, that's an RE topic: you're trying to understand how the program works. (Assuming you don't have the source code, otherwise this is straight programming/debugging.) Searching for a security vulnerability isn't on-topic, but understanding the nature of a vulnerability or other bug is.
“What is a good way of exploiting heap overflows?” No, that's not RE any more. You're no longer trying to understand how the program works, you're trying to make it behave differently.
Yes, absolutely. It is necessary to understand software exploitation to perform effective vulnerability research, and vulnerability research is a very common application of reverse engineering. There is only a fine line between vulnerability discovery and exploitation, and it would be silly to allow one but not the other.
If this is not clear, consider that the goal, and ultimately, the definition of reverse engineering is to develop understanding of a system. And indeed, writing a proper exploit is an exercise in exploring the workings of a system on a very intimate level.
I side with Gilles. The first one I would consider appropriate, the second one off-topic, even if borderline off-topic.
And that's not about the "well-documented or not" point. Just because RCE is a vital tool in vulnerability research doesn't mean this relation is commutative.
While I see the risk in locking ourselves (our community) into a niche with the focus on certain RCE aspects as one extreme or cannibalizing the more technical aspects of security.SE as the other, I also think we need to draw a line somewhere.
It's a fine line indeed and I see that the more I think about it. But when you open that door, all kinds of vulnerability research related questions may trickle in as well. And it'll be harder to fend off those questions and justify fending them off when you blur the scope of what's on-topic and what's not. Such as "which fuzzing frameworks exist to find type XYZ vulnerabilities ...". Which - I reckon - would be clearly off-topic. But a new user might argue that the "what is a good way of exploiting heap overflows?" question is also about vulnerability research.