Y Combinator Spring 2026

Overview

The Spring 2026 Y Combinator cohort represents a vibrant mix of 196 early‑stage startups, each pushing the boundaries of web‑centric product development. While the collective mean security rating sits at 65 / 100—a respectable mid‑range score—the most striking insight is the sheer prevalence of missing defensive HTTP headers. Over half of the cohort (129 sites) lack an X‑Frame‑Options header, and a comparable 157 sites are missing a Content‑Security‑Policy (CSP) altogether. These gaps point to a shared opportunity: strengthening baseline browser‑level protections could lift the overall posture dramatically without requiring major architectural changes.

What we found

Critical and high‑severity issues dominate the landscape. Across the cohort there were 5 critical findings and 239 high‑severity detections. The most widespread high‑severity problem is the absence of a Content‑Security‑Policy header, discovered on 157 of 196 sites (detected 157 times in total). CSP is a cornerstone defense against cross‑site scripting and data‑exfiltration; without it, browsers will execute any inline script or resource the page loads, dramatically expanding the attack surface.

Equally common is the use of React’s dangerouslySetInnerHTML, flagged on 134 sites (415 total detections). This API bypasses React’s built‑in XSS sanitisation, allowing raw HTML to be injected directly into the DOM. When paired with the missing CSP, the risk of client‑side injection escalates.

Missing Strict‑Transport‑Security (HSTS) headers affect 54 sites (detected 54 times). HSTS instructs browsers to enforce HTTPS connections, preventing downgrade attacks and cookie‑theft over insecure networks. Its absence leaves users vulnerable to man‑in‑the‑middle manipulation, especially on public Wi‑Fi.

A smaller but still notable subset of sites (5 sites each) submitted forms to external domains and performed client‑side redirects via window.location. These behaviors were detected 8 and 5 times respectively and can expose users to phishing or data leakage if the external endpoints are not fully vetted.

Medium‑severity findings round out the picture. While less severe than the header omissions, they reveal common development patterns that merit attention. Missing X‑Frame‑Options appears on 129 sites (detected 129 times), which can enable click‑jacking attacks. Unchecked postMessage listeners were found on 114 sites (140 detections), potentially allowing malicious frames to communicate with the page. Dynamically injected script tags show up on 110 sites (361 detections), a technique that can be abused to load compromised third‑party code. Publicly accessible JavaScript source maps affect 100 sites (721 detections); while useful for debugging, they expose original source files and can aid attackers in locating vulnerabilities. Finally, an overly permissive CORS policy (Access‑Control‑Allow‑Origin *) is present on 91 sites (detected 91 times), granting any origin the ability to read resources and widening data‑exfiltration vectors.

Overall, the cohort logged 1 839 medium, 1 160 low, and 3 678 informational findings, underscoring a dense layer of best‑practice gaps that, if addressed, would collectively raise the security maturity of the group.

Who’s leading

Among the scanned startups, AbInitio Bio achieved the sole “A” grade, placing it at the top of the cohort’s security leaderboard. No other company reached the A tier, and the distribution shows a heavy concentration in the C range (140 sites), with modest representation in B (33 sites) and D/F (22 sites combined).

What this means

These results constitute a diagnostic snapshot of the Spring 2026 Y Combinator cohort—not a final verdict. The patterns identified—particularly the missing CSP, HSTS, and X‑Frame‑Options headers—are low‑effort mitigations that can substantially improve each startup’s resilience against common web‑based attacks. Companies are encouraged to request their private, detailed report to see exactly where their site stands, prioritize remediation, and track progress over time. By treating this data as a foundation for continuous improvement rather than a static scorecard, the cohort can collectively elevate its security posture while maintaining the rapid innovation that defines Y Combinator startups.