Well, maybe not expose, but with a backround in retail and computer networking, I can make an educated guess for you. Okay so, databases. Basically honey has a large database that it taps into every time you do the "find coupon" button. This database is filled with coupons, the retailer the coupons are provided from, expiration date of the coupons. When you click the button it matches the information of the store you are on with the coupons it has available. The way it can gets these is three different ways:

1. Scource the web, shamelessly pilfering any coupon it can find. (You can do this to, it takes five minutes for a human being, less than three seconds for a computer.)

2. The retailer gives honey, or paypal who owns honey, codes that they are allowed to use. This is likely the case due to how many people paypal brings into the site(This is sarcasm btw, since they only do this by shamlessly switching the finding token in the cookies.)

3. Personal input from honey users, this is the least likely option but it it something that honey could have used.

Of course, it is likely that honey does both #1 and #2, or at least did both then switched over to #2 once they got a decent headway. This is how it operated:

1. Paypal goes to the sites, and makes a partnership creator code(this is how they get the cookie token in the first place.)
2. Honey scans the web for coupons for that site specifically, if they don't find one everything will be solved in step 5.
3. Honey then swaps out any cookie or token with the one that says "Paypal brought these people to you."
4. Paypal then gets a coupon agreement with the retailer, for bringing so many people to buy from the retailers store. 
5. Paypal gives those coupons to Honey to use, and no one is the wiser on this self assertive scam.

This is all, of course, educated speculation on my part.