Feels like a disaster waiting to happen.
Obviously it’s not something everyone is going to be comfortable sharing, but YC is transparent about what is shared and how it’s used.
Edit:
I now see you have to explicitly run it in every directory you want shared - i.e., it doesn’t t scan your whole disk looking for stuff to upload. So there’s every opportunity to limit what it uploads to only what you want to share.
>curl -fsSL https://paxel.ycombinator.com/upload.sh | bash
Point in case.
Trustworthy people will ask you to give them the right amount of access, they won't ask you for infinite access and ask you to trust them that they won't use it. Would you trust a contractor that asks for root, and your master password when they could have requested a specific user or some specific files?
Edit:
I’ll add this point as people always seem to want to raise the spectre of YC or the AI platforms stealing people’s code or ideas via these sorts of tools.
The value of any code or ideas is immaterial compared to the value of identifying talented people who can then be offered opportunities such as attending Startup School, being funded by YC, getting jobs at YC-funded companies or YC itself.
It’s one of pg’s oldest dictums, that ideas alone are worthless, and only working products and the people that build them are worth anything. Nobody at YC thinks any differently about that these days.
1. Yes you can audit client side and network interface, but not server side.
2. does 'curl $URL | sh' invite users to audit? Or to trust blindly? It's the equivalent of presenting a contract with 'sign here' stickers and pushing you to sign it quickly like it's nothing. Does not signal trustworthiness.
>I’ll add this point as people always seem to want to raise the spectre of YC or the AI platforms stealing people’s code or ideas via these sorts of tools.
>The value of any code or ideas is immaterial compared to the value of identifying talented people who can then be offered opportunities such as attending Startup School, being funded by YC, getting jobs at YC-funded companies or YC itself.
>It’s one of pg’s oldest dictums, that ideas alone are worthless, and only working products and the people that build them are worth anything. Nobody at YC thinks any differently about that these days.
I do agree and share this point, ideas are worthless. But this doesn't deal with ideas, it deals with code, which as a software startup I don't feel the need to convince you of its value and the risks of leaking it. If you think your code is worthless, close your startup.
By many definitions, prompts are source code, and what we used to call source code is now target code. So this indeed does leak your source code. It's not just an IP blunder to leak your source code this carelessly, but it's a security blunder to do so. "But Kerchoff's principle.." no, Kerchoff's principle is that you should design your system as if source code were public, not that leaking source code has no negative security effect.
Also, is it possible that YC is taking advantage of the 'your ideas are worthless' dictum? Just share your ideas with YC, they are too big to care about your stupid idea. But they are gathering intel on over hundred of thousands of startups, and the ratio of applicants to fundings is continuously going down.
And sharing your idea with a single potential investor, isn't the same thing as submitting your idea (and implementation details), to a system built by people who don't give a shit about internals or security, and that use third party tools and services from different countries to process your data in ways that they don't give a fuck either.
What guarantee do you have that by using YC's vibecode data gathering tool, your data won't end up in a training set that will make it easier for a competitor with the same idea as you to find your solution?
A decade ago maybe your idea was worthless and joining YC was a contrarian bet. Nowadays, this data is clearly worth something, and applying to YC is as mainstream as applying for a job, and both of these mainstream 'apply for a 0.1% chance at the privilege of working with us' tend to grow completely asymmetric and exploit the underdog as much as they allow themselves to be exploited.
The entire purpose of Startup School for YC is to build great relationships with the most promising talent. The scale and cost of the event is vast, and the benefits for attendees are huge.
It’s a three day event with main-stage interviews with several top figures in the tech world and many other intimate events with YC partners, industry experts and fellow attendees. Much of the effort in organizing the event is maximizing the chances that attendees will meet other attendees with things in common so they can build relationships and maybe work on important projects in the future. Of course, YC hopes to be able to fund the most promising startups that come out of this, but nobody is obligated to apply to YC or take YC funding if it’s offered.
What I’m trying to convey here is that it’s in YC’s utmost interests to build trust and earn respect from the people who are participating in these programs, and there is no way in a million years that some code or implementation detail exposed in a chat transcript is going to be more valuable than building very positive, mutually trusting relationships with all participants and applicants over the long term.
What's more important, the code? or the source?
It's the source. The mistake thousands of people are making is that the source no longer looks like code, and the target code now looks like what source code used to be. They are looking at the aesthetics instead of the fundamentals.
It's literally the hardest thing in business for investors and employers by far: finding good talent to invest in or employ, and earning/keeping their trust. YC spends unimaginable amounts of money and effort each year to keep doing that, as it has done for two decades. Startup School is just that latest and biggest example of that.
It doesn't even pass basic logic that YC would steal some gem of an idea from someone's transcript and hand it to someone else to build. Everyone who is talented enough to build it is busy building products based on their own ideas, and the very best person to build a product is the person who had the idea to build it.
>YC spends unimaginable amounts of money and effort each year to keep doing that, as it has done for two decades.
Yeah, that or they built their reputation early on and are now coasting on that. It's an industry whose explicit objective is to build companies (build reputations) and then exit and sell them, would you be surprised if YC itself did that?
>It doesn't even pass basic logic that YC would steal some gem of an idea from someone's transcript and hand it to someone else to build.
More likely is the opposite, they get 100k startup applications and they know what ideas people are pursuing and should be avoided, and which might be worth looking into. The former become would target demographics for shovel selling as well, so the 1% that actually gets into YC might setup shop selling to the other 99%. It's theoretical, but these are all attacks that emerge from the basic violation of sharing your source code. To be clear, I don't think that YC employees are starting startups, the threat model is that they act through their picks, and they strengthen their picks at the expense of their non-picks. It's like a russian roulette of startups, which isn't necessarily a bad idea.
>Everyone who is talented enough to build it is busy building products based on their own ideas,
Like, I get that, but also don't overcorrect into the naïve take that market intelligence is worthless or doesn't exist, especially when that take is 20 years old, if you treat that as your strategic advantage over the population, it's more likely that it's going to be used to take advantage of you.
Be moderate, share your idea, don't share everything. Share to individuals, don't share to massive data gathering systems that may use your data as training data for machine learning models. Basic stuff really.
Everything you’re speculating about regarding YC’s potential to steal ideas, along with the notion that they are “coasting”, is easily disproven by what YC is doing, literally right now.
Startup School 2026 is the most costly and elaborate event YC has ever presented. YC is hosting about 7500 people at the event, and entertaining them (meals, parties, small-group sessions and dinners) and paying for flights for many of them from elsewhere in the country and world. They recently did a similar thing in India, and are constantly running outreach events at colleges around the world. That’s in addition to running four YC accelerator batches per year, funding nearly 1000 companies annually (and hoping to grow that).
This is the opposite of “coasting” and is completely at adds with any notion what YC really wants to do is steal IP or ideas. YC’s business collapses if it loses the trust of the most promising talent.
Also, I appreciate that it's probably all fine, and that my attack scenarios are mostly theoretical, and that YC took care in developing security measures for Paxel, and that maybe I'm paranoid.
But I believe in a security model that doesn't rely just on trust, but on system level guarantees, where we install things not by running 'curl $URL | bash', but by robust technologies like OAuth. Yes, maybe it's a bit harder to build, and the 'UX' of installing these things will not be as clean. I'm just not on board with the piping curl into bash fad. I'm sure there's a sweetspot of trustingness and scrutiny.
To take some heat off YC, they are not the only ones, consider socket.dev, a security product, they tell you that they will not read your code, only the requirements.txt and package.json type of files, but when you install it, GitHub gives them full access to repos, we have had file level permissions for years, but suddenly it's not possible to request that level of granulairty for permissions.
I'm sure that there's a sweetspot between trustworthiness and rigour, but 'curl|bash' and 'deputyless permissions' is clearly on the too-trustworthy end of the spectrum, fantastically so, it makes me feel the overton window is shifting towards extremist levels of disregard for security.
But maybe I'm wrong, I'd love to read a defense of 'curl|bash', 'give the agent access to all the company data' and 'you can just ask the LLM to not read some data'.
If you have a suggestion for how to scope down the permissions of our app, we’re all ears. But based on our research, it’s not possible.
More info documenting each permission: https://docs.socket.dev/docs/permissions
;)
Identifiers included in uploaded data. Information you upload to use the Services may include personal identifiers such as your name and email address (including names and email addresses of repository contributors), as well as other identifiers that may appear in commit metadata, file paths, transcripts, or other uploaded materials.
AI coding-agent transcript-derived content. Per-session narratives, certain session events including file paths and truncated command text, prompt excerpts, steering traces, and dispatch metadata. This data may include local file paths (e.g., directory structures such as /Users/…) and other contextual information that could be associated with an individual. Raw conversation history, full prompts, full agent responses, and full tool outputs do not leave your machine.
Information you upload may include Personal Information relating to other individuals (for example, repository contributors). You represent that you have the necessary rights and permissions to provide such information to us for processing in connection with the Services.
Usage patterns and activity intervals. We may derive and store information about your usage patterns, such as session timing and working-hour intervals, based on timestamps associated with your activity.