Y Combinator Spring 2026

Overview

The Spring 2026 batch of Y Combinator startups is a vibrant mix of early‑stage innovators, with 196 companies scanned for their public‑facing security posture. Their collective score averages 65 / 100, and the distribution is heavily weighted toward the middle grades (140 C, 33 B). The single most striking insight is the prevalence of high‑severity issues: over 80 % of the cohort (157 sites) are missing a Content‑Security‑Policy header, a cornerstone defense against cross‑site scripting and data injection attacks. This signals a systemic gap in baseline web‑app hardening that, if addressed, could lift the overall security maturity of the entire group.

What we found

Critical and high‑severity findings

Across the cohort we recorded 5 critical findings and 239 high‑severity findings. The most common high‑severity weakness is the absence of a Content‑Security‑Policy (CSP) header, discovered on 157 of 196 sites (detected 157 times in total). Because a CSP tells browsers which resources may be loaded, its omission leaves applications open to a broad class of injection attacks.

Equally widespread is the use of dangerouslySetInnerHTML in React, flagged on 134 sites with 415 total detections. This pattern indicates that many startups are directly inserting HTML strings into the DOM, bypassing React’s built‑in escaping and increasing the risk of XSS if any user‑controlled data slips through.

Missing Strict‑Transport‑Security (HSTS) headers affect 54 sites (detected 54 times). Without HSTS, browsers are not forced to use HTTPS for future connections, exposing users to downgrade‑or‑strip attacks.

Two less frequent but still high‑severity behaviours were observed: form submissions to external domains (5 sites, 8 total detections) and window.location assignments (5 sites, 5 detections). Both can be abused for phishing or open‑redirect attacks when not carefully validated.

Medium‑severity observations

While the focus remains on the most severe issues, a handful of medium‑severity findings deserve attention. Missing X‑Frame‑Options was seen on 129 sites (66 % of the cohort), which could enable click‑jacking attacks. postMessage listeners without origin checks appeared on 114 sites, raising the chance of cross‑origin data leakage. Dynamically injected script tags (110 sites) and publicly accessible JavaScript source maps (100 sites, 721 detections) further illustrate a pattern of runtime code that could be leveraged by an attacker. Finally, overly permissive CORS policies (Access-Control-Allow-Origin: *) were detected on 91 sites, potentially allowing any origin to read sensitive API responses.

Low‑ and informational findings

The scan also produced 1,160 low‑severity and 3,678 informational findings. These include routine configuration quirks and best‑practice deviations that, while not immediately exploitable, point to opportunities for tightening overall hygiene.

Who's leading

Among the 196 participants, AbInitio Bio distinguished itself with an A‑grade assessment, reflecting a comprehensive implementation of security headers, safe React patterns, and robust transport protections. No other company in this cohort reached the top tier, underscoring the challenge of achieving a truly hardened web presence at early stages.

What this means

The data presented here is a diagnostic snapshot—a starting point for each startup to understand where its public surface stands against common web‑app threats. Companies that wish to dive deeper into the specific instances, remediation recommendations, and a full risk‑ranking should request their private, detailed report. The goal is not to assign blame but to provide actionable insight that can be woven into product roadmaps, security sprints, and investor discussions. By addressing the highlighted high‑severity gaps—especially CSP deployment and safe React rendering—Y Combinator Spring 2026 startups can collectively raise their security baseline and protect both their users and their emerging brands.