How to evaluate the security of a certain encryption method? I've been slinging code for a while now, but relatively new to encryption/security. What should I look for when evaluating an encryption method in the wild?

For example, the Standard File protocol supports E2E encryption. It's implemented here: https://github.com/standardnotes/web/blob/6fd5719/app/assets/javascripts/app/services/encryption/crypto.js

To my untrained eyes, that looks reasonably secure. How could I spot red flags? For example, is splitting a key in thirds a good idea?

I'm not asking about evaluating this specific library, rather, patterns or resources I can use to determine security. One idea that comes to mind is placing a public bounty as a challenge to break the encryption. Telegram did this with a $300k bounty.
How could I spot red flags? 


The red flag is actually the entire red zone (like trees in the forrest...). If there is code for encryption at all, you better throw it away unless it's some proper library from a source with good reputation for exactly this kind of thing.

It is something different, if they use a cryptographic library properly, that can be achieved by non-experts. But implementation of actual encryption ... the chances of a crucial error are immense.


  For example, the Standard File protocol supports E2E ...


If you look at the homepage, the section developers is only listed in the menu, there is no matching content. However, on the positive site they don't actually implement encryption, they use CryptoJS as library. 


  For example, is splitting a key in thirds a good idea?


In general: Actually it doesn't make any sense, because you should create keys fitting to their task and why would someoen want to split a key in a meaningless way? If the goal was to split it securely in the sense of a secret sharing scheme (e.g. that you can only reassemble any information with both halves), that's something totally different.


  Telegram did this with a $300k bounty.


The Telegram "challenge" is bogus anyway. It is basically "I think of a number, give you no information, and if you can guess it, you win".

That is not how cryptanalysis works, that is not how security works. By doing that, they already proved that they don't understand much about these fields.

Here are a few articles about that:


Why You Should Stop Using Telegram Right Now 
Related is this older article by Bruce Schneier on crypto contests