Obaid hacks YC's Paxel founder rankings, gets Startup School invite
After revealing a vulnerability that let anyone forge YC founder scores, partner Jared Friedman quickly fixed the flaw and extended a Summer 2026 Startup School invitation.
By Ryan Merket · Published
Primary source: Hacker News
Why it matters
The breach shows that a single security flaw in YC's applicant analytics can distort founder rankings, highlighting the urgent need for hardened APIs in accelerator tools.
In early June 2026, an independent developer known as Obaid (@wtfobaid) uncovered a critical flaw in Y Combinator’s proprietary scoring tool, Paxel. Paxel, which applicants for the accelerator must run locally, gathers a developer’s entire git history, feeds it to a hosted LLM, and returns a report that YC uses to rank candidates on five axes – execution leverage, steering, engineering quality, product thinking, and planning.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.