y-combinator cybersecurity startup-culture developer-tools

I got into YC Startup School by hacking it

obaid.wtf

July 24, 2026

7 min read

🔥🔥🔥🔥🔥

51/100

Summary

Y Combinator was scoring over 100,000 founders globally through Paxel, which had a vulnerability allowing score forgery due to an unvalidated HMAC. After disclosing the issue, Y Combinator quickly patched it and invited the hacker to attend Startup School in San Francisco.

Key Takeaways

The author discovered a vulnerability in Y Combinator's Paxel system that allowed anyone to forge and push scores to its ranking database.
After publicly disclosing the vulnerability, Y Combinator quickly responded by patching the issue and inviting the author to attend Startup School in San Francisco.
Over 1.2 million coders have uploaded their reports to Y Combinator through Paxel, but the author was the first to identify and exploit the vulnerability.
The Paxel installation process involves a single command that scans the user's system and uploads data without requiring further user intervention.

Read original article

View story →

Coverage & discussions

Hacker News · obaid.wtf

I got into YC Startup School by hacking it ↗

Community discussions

Hacker News discussion ↗

Historical count: 5 · 5 saved in sample · Historical sample

Analysis ready

Community Sentiment

Negative

Positives

Paxel could be a fun tool for developers to analyze their LLM-assisted code, sparking curiosity about AI's role in coding.
YC's inclination towards applicants who think outside the box aligns with the hacking culture, which can foster innovative thinking.

Concerns

The idea of running a script that uploads code analysis to an untrusted third party raises major ethical concerns about IP security.
Using an AI tool like Paxel to score applicants based on their coding habits feels like a recipe for penalizing creative workflows and diverse approaches.
The potential for security vulnerabilities in Paxel's operation suggests a disaster waiting to happen, particularly regarding the handling of sensitive data.