Y Combinator Summer 2026

Overview

The Summer 2026 batch of Y Combinator startups presents a mixed picture of web‑application hygiene. Scanning 233 member sites produced an average security rating of 66 / 100, with the bulk (73 %) earning a grade of C. The most striking insight is the prevalence of high‑severity client‑side injection weaknesses: Missing Content‑Security‑Policy headers were found on 186 of the 233 sites, and unsafe DOM‑manipulation patterns (innerHTML assignments and React’s dangerouslySetInnerHTML) appear on a similar scale. While a handful of companies are already demonstrating strong practices, the cohort as a whole shows ample room for improvement in defending against cross‑site scripting and related attacks.

What we found

Critical findings – The scan identified five critical issues across the cohort. Because the data are aggregated for privacy, we cannot break these down by individual startup, but the presence of any critical flaw signals a need for immediate remediation wherever they exist.

High‑severity patterns –

• Missing Content‑Security‑Policy header – Detected on 186 of 233 sites (≈ 80 %). This header is a primary defense against script injection; its absence leaves browsers free to execute any script that can be loaded, dramatically widening the attack surface. The issue was reported 186 times in total, meaning each affected site triggered the check once.
• innerHTML assignment – Found on 182 of 233 sites (≈ 78 %). Directly inserting HTML strings without sanitisation is a classic XSS vector. The scan recorded 376 total occurrences, indicating many sites contain multiple vulnerable assignments.
• dangerouslySetInnerHTML usage (React) – Observed on 145 of 233 sites (≈ 62 %). This React‑specific API bypasses the framework’s built‑in escaping, and misuse can introduce the same injection risks as raw innerHTML. It was flagged 441 times, showing that several components per site often employ the API unsafely.
• Missing Strict‑Transport‑Security (HSTS) header – Detected on 61 of 233 sites (≈ 26 %). Without HSTS, browsers are not forced to use HTTPS for subsequent visits, exposing users to downgrade attacks. Each affected site triggered the check once, for a total of 61 occurrences.

Medium‑severity observations – While the cohort’s high‑severity issues dominate the narrative, a few medium‑level problems also emerged: 156 sites (67 %) lack X‑Frame‑Options, 126 sites (54 %) inject script tags dynamically, and 124 sites (53 %) serve an overly permissive CORS policy (Access-Control-Allow-Origin: *). Additionally, 100 sites (43 %) expose JavaScript source maps publicly, leaking potentially sensitive build information. These findings, though less urgent than the high‑severity injection gaps, still merit attention because they can facilitate information gathering and indirect attacks.

Overall, the tally of findings—5 critical, 260 high, 1 900 medium, 1 275 low, and 3 543 informational—highlights a landscape where many startups have adopted basic HTTPS and informational best practices but still need to harden client‑side defenses.

Who’s leading

Four companies earned an “A” grade in this assessment: Meteoric, Isengard Industries Inc, Ekpa, Praxis Robotics, and Robocurve. Their scores indicate a comprehensive application of security headers, safe DOM handling, and overall robust configuration relative to the cohort. These organisations serve as practical benchmarks for their peers, demonstrating that high‑grade security postures are achievable even within the rapid‑development cycles typical of early‑stage startups.

What this means

The snapshot presented here is diagnostic, not punitive. It shows where the Summer 2026 Y Combinator cohort collectively excels and where systemic gaps remain. Companies that wish to dive deeper into the specific findings affecting their own sites can request the full private report, which includes detailed remediation guidance and prioritized action items.

Improving the highlighted high‑severity issues—particularly CSP adoption and safe DOM manipulation—will raise the overall security grade and reduce the risk of client‑side exploits. As the cohort continues to grow and iterate, regular reassessments will help track progress and encourage a culture of proactive security hygiene across all Y Combinator startups.