Comments
Hacker News
> I uncovered Y Combinator was scoring 100k+ founders around the world through Paxel
Alright, my ears are wide open. Tell us more, how did YC use the private submission data from thousands of founders to score them? They fed some 3rd-Party AI all personal data to score who should get an interview? I can't be the only one here seeing a bad news story unfolding in real time...
by siva7
Am I misreading this, or is ycombinator running a tool that transfers IP from an applicant’s machine to OpenAI and then transfers the generated summaries into their own servers. And that tool has some “webapp security 101” level vulnerability in it.
Feels like a disaster waiting to happen.
Why does the author keep mentioning that a one line bash command that downloads a bunch of crap is “great UX”?
by tacker2000
For the longest time, the YC application included the question "What was your greatest (non-computer) hack?". They have always liked people who think of ways to work around existing systems. So it's no surprise that their response was positive. Also, all the principals are ex-founders, mostly engineers, who totally understand hacking culture.
Sadly, it looks like they took that question off the application though.
by jedberg
So let me get this straight... technical founders are providing limitless access to their IP, and this is supposed to be a positive indicator that they would be a good founder? Thats wild
by jppope
I could be mistaken, but isn't Paxel a tool that YC *itself* built to understand how founders/applicants apply AI? If so, this feels less scary than some of the comments (i.e. not 3rd party).
Also, not trying to take shots, but should the title be "I got into YC Startup School by hacking it" instead? Isn't that different than the main YC program?
All in all, you did them a solid by finding and responsibly disclosing. Nice job.
by smcnc
> Based on Paxel’s own site, 1.2 million+ coders have so far uploaded their reports to YC.
I checked the Paxel website and it says this:
> So far, 1,543,553 sessions have been uploaded and analyzed.
The count is for sessions, not coders. I assume the tool uploads a lot of sessions from each person who uses it.
That’s a large number, but it’s not a million different people. I am surprised that so many people think it’s a good idea to download a run a program which gathers up their coding sessions and submits information about them.
by Aurornis
Against better judgement, I ran it on my repo. Poking at the "Ask anything about the report" bot, it penalizes me heavily for not having "positive tracked outcomes", as I don't report back to Claude what the outcome is. It wanted me to do this:
"At the end of research-heavy sessions, add a tiny closure note:
Decision: Use CacheMountStore with registry/local/GHA backends.
Why: GHA cannot expose the same content.Ingester path, local import has discovery issues, registry can resolve by tag.
Proof / current artifact: See files X, Y, Z. Subagent found A, B, C.
Next action: Implement interface in package N. Do not add new cache-mount flags yet. Use mode=cache-mount on existing cache flags."
There's no need for this, Claude is not my task tracker.
It also penalized me for:
- Using Claude to introspect a codebase as throwaway work and ` not close with a crisp “acceptable / risky / copy this / avoid this” decision this session.`. No action was needed, it wasn't an actionable session!
- Using Fable for code review. `Several BuildKit subagent sessions produced research reports, but the transcript does not show whether those findings became implementation choices.` Yes, Fable launches subagents to code review. Valid findings get turned into fixes or WONTFIX.
- `The Cloudflare CI upload failure got narrowed well, especially after you supplied the exact timestamp and challenged the /v2 routing recommendation, but the session ended without a chosen next diagnostic owner or action this session.` There's no need to pick a next diagnostic owner when I'm a solo founder with no employees.
by a_t48
Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- > I uncovered Y Combinator was scoring 100k+ founders around the world through Paxel
Alright, my ears are wide open. Tell us more, how did YC use the private submission data from thousands of founders to score them? They fed some 3rd-Party AI all personal data to score who should get an interview? I can't be the only one here seeing a bad news story unfolding in real time...
by siva7 - Am I misreading this, or is ycombinator running a tool that transfers IP from an applicant’s machine to OpenAI and then transfers the generated summaries into their own servers. And that tool has some “webapp security 101” level vulnerability in it.
Feels like a disaster waiting to happen.
- Why does the author keep mentioning that a one line bash command that downloads a bunch of crap is “great UX”?by tacker2000
- For the longest time, the YC application included the question "What was your greatest (non-computer) hack?". They have always liked people who think of ways to work around existing systems. So it's no surprise that their response was positive. Also, all the principals are ex-founders, mostly engineers, who totally understand hacking culture.
Sadly, it looks like they took that question off the application though.
by jedberg - So let me get this straight... technical founders are providing limitless access to their IP, and this is supposed to be a positive indicator that they would be a good founder? Thats wildby jppope
- I could be mistaken, but isn't Paxel a tool that YC *itself* built to understand how founders/applicants apply AI? If so, this feels less scary than some of the comments (i.e. not 3rd party).
Also, not trying to take shots, but should the title be "I got into YC Startup School by hacking it" instead? Isn't that different than the main YC program?
All in all, you did them a solid by finding and responsibly disclosing. Nice job.
by smcnc - > Based on Paxel’s own site, 1.2 million+ coders have so far uploaded their reports to YC.
I checked the Paxel website and it says this:
> So far, 1,543,553 sessions have been uploaded and analyzed.
The count is for sessions, not coders. I assume the tool uploads a lot of sessions from each person who uses it.
That’s a large number, but it’s not a million different people. I am surprised that so many people think it’s a good idea to download a run a program which gathers up their coding sessions and submits information about them.
by Aurornis - Against better judgement, I ran it on my repo. Poking at the "Ask anything about the report" bot, it penalizes me heavily for not having "positive tracked outcomes", as I don't report back to Claude what the outcome is. It wanted me to do this:
"At the end of research-heavy sessions, add a tiny closure note:
Decision: Use CacheMountStore with registry/local/GHA backends.
Why: GHA cannot expose the same content.Ingester path, local import has discovery issues, registry can resolve by tag.
Proof / current artifact: See files X, Y, Z. Subagent found A, B, C.
Next action: Implement interface in package N. Do not add new cache-mount flags yet. Use mode=cache-mount on existing cache flags."
There's no need for this, Claude is not my task tracker.
It also penalized me for:
I'm choosing not to attach a report to my application. As a side note, nobody needs to see "my greatest crashout", it's embarrassing enough for me to see it for myself, much less show others.- Using Claude to introspect a codebase as throwaway work and ` not close with a crisp “acceptable / risky / copy this / avoid this” decision this session.`. No action was needed, it wasn't an actionable session! - Using Fable for code review. `Several BuildKit subagent sessions produced research reports, but the transcript does not show whether those findings became implementation choices.` Yes, Fable launches subagents to code review. Valid findings get turned into fixes or WONTFIX. - `The Cloudflare CI upload failure got narrowed well, especially after you supplied the exact timestamp and challenged the /v2 routing recommendation, but the session ended without a chosen next diagnostic owner or action this session.` There's no need to pick a next diagnostic owner when I'm a solo founder with no employees.by a_t48