I got into YC Startup School by hacking it

In one line

tldr: I uncovered Y Combinator was scoring 100k+ founders around the world through Paxel, I broke it (possible easter egg) + found a vulnerability that let anyone forge and push any score to their ranking database, courtesy of an unvalidated hmac

Opening excerpt

Latest update: YC admirably, didn’t mind. In just a couple hours after first-public-disclosure Jared Friedman himself replied, announced the patch, and invited me to attend the Startup School in SF this summer! I’d also disclosed it in private through email 12 days earlier to no response. But publicly at least the process works.

this is a re-write of an earlier draft where I first made the disclosure public. it was badly written, sleep-deprived and I didn’t feel good enough about it to publicize

It all started early June, when I found the application form for Startup School 26’ (referred by Dhanush: shoutout Audora S26, incredible stuff coming!!). I found that this year, YC wanted me to use something called Paxel on my computer as part of the application.

I should run a script, a very easy-to-use cURL one-liner that installed something on my computer and analyzed every line of code I’ve written with a coding agent, compile a report, and upload it to YC’s servers.

(Excerpted from the original; full article via the source link below.)

This story hit the Hacker News front page today (82 points / 55 comments, via obaid.wtf). Our Tech Radar aggregates daily signals on AI engineering, backend architecture and DevOps — browse the related services and further reading below, or get in touch with our team.