GoKawiiltldr: I uncovered Y Combinator was scoring 100k+ founders around the world through Paxel, I broke it (possible easter egg) + found a vulnerability that let anyone forge and push any score to their ranking database, courtesy of an unvalidated hmac
Latest update: YC admirably, didn’t mind. In just a couple hours after first-public-disclosure Jared Friedman himself replied, announced the patch, and invited me to attend the Startup School in SF this summer! I’d also disclosed it in private through email 12 days earlier to no response. But publicly at least the process works.
this is a re-write of an earlier draft where I first made the disclosure public. it was badly written, sleep-deprived and I didn’t feel good enough about it to publicize
— — —
It all started early June, when I found the application form for Startup School 26’ (referred by Dhanush: shoutout Audora S26, incredible stuff coming!!). I found that this year, YC wanted me to use something called Paxel on my computer as part of the application.
I should run a script, a very easy-to-use cURL one-liner that installed something on my computer and analyzed every line of code I’ve written with a coding agent, compile a report, and upload it to YC’s servers.
Paxel’s main site tells me the main feature is I get to “visualize” my work and get assigned fun attributes like “Which archetype are you?” and “What’s your biggest crashout?” That sounded fun.
But I wanted to know exactly how it did that, and when my curiosity starts creeping into obsessive territory it’s basically a toss-up that either ends in a legendary crash-out or doing something great. thankfully, in this case it was the latter.
I also can’t lie: I really wanted (or needed) to hack it. I knew I was starting from a disadvantage when filling out my application (no formal, ivy league education), but I knew this would be a fast-track, surefire way into confirming my acceptance. I’m not delulu, I knew it would be insane if I was able to do it, but why not go all in?
Based on Paxel’s own site, 1.2 million+ coders have so far uploaded their reports to YC. And seeing those numbers it’s honestly shocking I was the first person in the world to figure and break all of this.
... continue reading