7 hours ago
- The author discovered Y Combinator's Paxel tool scores founders and found a vulnerability allowing forged scores due to an unvalidated HMAC.
- After a public disclosure, YC's Jared Friedman promptly patched the issue and invited the author to Startup School in SF.
- The hack involved boosting scores via a custom tool, with over 20 users ranking in YC's top 1% before the fix.
- The vulnerability stemmed from missing cryptographic signatures, where the nonce didn't tie to LLM results, enabling score manipulation.
- Author suggests encrypting client-invisible fields to prevent similar issues, though this is optional for security.
- The author shares a resource to view raw scores and seeks connections for finding a co-founder at Startup School.