How I got into YC by hacking it | obaid’s longer thoughts

tldr: I uncovered Y Combinator was scoring 100k+ founders around the world through Paxel, I broke it (possible easter egg) + found a vulnerability that let anyone forge and push any score to their ranking database, courtesy of an unvalidated hmac

Latest update: YC admirably, didn’t mind. In just a couple hours after first-public-disclosure Jared Friedman himself replied, announced the patch, and invited me to attend the Startup School in SF this summer!<br>I’d also disclosed it in private through email 12 days earlier to no response. But publicly at least the process works.

Jared Friedman, July 11 2026

this is a re-write of an earlier draft where I first made the disclosure public. it was badly written, sleep-deprived and I didn’t feel good enough about it to publicize

— — —

It all started early June, when I found the application form for Startup School 26’ (referred by Dhanush: shoutout Audora S26, incredible stuff coming!!). I found that this year, YC wanted me to use something called Paxel on my computer as part of the application.

I should run a script, a very easy-to-use cURL one-liner that installed something on my computer and analyzed every line of code I’ve written with a coding agent, compile a report, and upload it to YC’s servers.

Paxel’s main site tells me the main feature is I get to “visualize” my work and get assigned fun attributes like “Which archetype are you?” and “What’s your biggest crashout?” That sounded fun.

But I wanted to know exactly how it did that, and when my curiosity starts creeping into obsessive territory it’s basically a toss-up that either ends in a legendary crash-out or doing something great. thankfully, in this case it was the latter.

I also can’t lie: I really wanted (or needed) to hack it. I knew I was starting from a disadvantage when filling out my application (no formal, ivy league education), but I knew this would be a fast-track, surefire way into confirming my acceptance. I’m not delulu, I knew it would be insane if I was able to do it, but why not go all in?

Based on Paxel’s own site, 1.2 million+ coders have so far uploaded their reports to YC. And seeing those numbers it’s honestly shocking I was the first person in the world to figure and break all of this.

— — —

As a side note before I get into it, I think the relative achievement of a “hack” in the world has diminished manyfold since agent-capable LLMs have arrived. That of course, pars with reality because of how much easier LLMs have made doing those. But I do think that ease is somewhat overestimated, both because of the many strange blindspots they have as well as the lack of a certain “hacking” or combative approach to intelligence. Whether that’s because of safety-neutering or simply the way they’re trained is a discussion for another time.

So although what they’re world-changing at is helping you go through the same material in 10x, and sometimes 50x less time (research, investigation), it is often a struggle to communicate with LLMs and keep your own mind sharp and independent when LLMs insist everything hackable is not — with near-perfectly plausible logic.

— — —

Paxel has an incredible UX, everything it does is handled from a single one-liner curl -fsSL https://paxel.ycombinator.com/upload.sh | bash. It will automatically scan your entire system, prompt you for questions, and handle the upload — you don’t have to worry about a thing after.

So the first starting point, naturally, was this install script. I first split it into 4 separate modules. When I tried breaking it in full every LLM I gave it to started hallucinating really badly (context window size increases are not perfect!)

The install script, turns out, actually didn’t run on its own. It downloaded an entire docker image hosting a ruby app, unwrapped that, and ran it locally through the docker installed on your computer. So the app is actually divided into two parts:

① ─▶ upload.sh 302KB install script. Handles auth, discovers projects, extracts git history, and initializes docker

② ─▶ the ruby app unwrapped from a docker image. it runs the actual full pipeline per-project.

It first groups all chat transcripts into a yc-invented unit of work, “episodes”. Each episode is all the commits per PR, failing that ─▶ Each commit in a 2 hour burst period ─▶ failing that, every single chat session becomes an individual episode.

Then, it uploads them to a yc-sponsored (interesting discovery!) free gpt-5.5 proxy hosted @ paxel-llm.ycombinator.com

gets back a summary per episode, rolls it in with other data, and uploads the final report to paxel.ycombinator.com/api/v1/results

And this is where I found that every piece of work you’ve done has been graded, scored, ranked by YC, and 1.2 million reports on earth’s coders have been compiled.

execution_leverage<br>steering<br>engineering_quality<br>product_thinking<br>planning

These are the core 5 axes the LLM grades you on and...