It depends upon the feature. If you can identify the API or function being called, you might be able to ask about that API, if that API is of sufficiently broad relevance (e.g., it is a platform API).
Also, if you can identify the class of vulnerability that you suspect is present, it is also possible there might be a good question lurking of the form "how do I test/confirm whether or not my web application is vulnerable to HPP attacks in a particular parameter of a particular page?" (or whatever; replace with your particular vulnerability class). This could be of broader utility.
But a question that is about whether your particular application happens to have a logic flaw is not likely to be of broader interest to the community.
The general principle is: can you find a question whose answers are likely to be of broader relevance to a larger community of security folks? If so, ask that question. If not, maybe it's not a good fit for this site.
Policy in company is such that testers shouldn't have access to source code so that they would be in the same circumstances as true "hackers".
That policy sounds a bit dubious to me. Maybe there's a good question here about how to educate management about how to perform penetration testing well, or about whether this policy is good or bad?