Y Combinator Winter 2026

Overview

The Winter 2026 batch of Y Combinator startups – 197 companies freshly scanned for their web‑security posture – paints a picture of a community still finding its footing. While the mean security score sits at 64 / 100, the grade distribution shows that a solid majority (68 %) are clustered in the “C” band, with only a handful breaking into “A” territory. The most striking takeaway is the prevalence of missing defensive response headers: Missing Content‑Security‑Policy (CSP) headers were found on 160 of the 197 sites, indicating a systemic gap in protection against content injection attacks.

What we found

Across the cohort the severity landscape is heavily weighted toward high‑impact findings: 6 critical issues, 249 high, 2 167 medium, 1 192 low and 3 493 informational detections. The high‑severity tier dominates the narrative because these weaknesses can be directly leveraged by attackers.

Missing Content‑Security‑Policy header (high) – Detected on 160 / 197 sites (81 %). Each site lacking CSP was flagged once, for a total of 160 detections. Without CSP, browsers have no explicit whitelist of allowed resources, leaving applications open to cross‑site scripting (XSS) and data‑injection attacks.

Missing Strict‑Transport‑Security (HSTS) header (high) – Found on 38 / 197 sites (19 %). This header forces browsers to use HTTPS for all future connections. Its absence means users can be downgraded to insecure HTTP, exposing session cookies and credentials.

window.location assignment detected (high) – Present on 8 / 197 sites (4 %). Scripts that programmatically rewrite the top‑level location can be abused for open‑redirect or phishing scenarios when combined with insufficient input validation.

Form submits to external domain (high) – Observed on 5 / 197 sites (3 %), with 6 total occurrences. When a form posts data to a third‑party origin, the originating site relinquishes control over data handling and may inadvertently expose sensitive information.

Dynamic eval() usage (high) – Detected on 5 / 197 sites (3 %). The eval function executes strings as code, a common vector for code‑injection attacks if the input is not strictly sanitized.

The medium‑severity findings, while more common, are listed here only for context:

• Missing X‑Frame‑Options header on 138 / 197 sites (70 %). This omission permits click‑jacking attacks, where malicious pages embed the vulnerable site in a hidden frame.
• Dynamically injected script tags on 116 / 197 sites (59 %), detected 475 times total, indicate runtime script loading that can bypass static analysis and introduce unvetted code.
• postMessage listeners without origin checks on 107 / 197 sites (54 %), detected 130 times, expose cross‑origin communication channels to spoofed messages.
• Public JavaScript source maps on 107 / 197 sites (54 %), detected 845 times, can reveal original source code and internal comments to attackers.
• Overly permissive CORS policy (Access-Control-Allow-Origin: *) on 101 / 197 sites (51 %). This blanket allowance lets any origin read resources, facilitating data exfiltration.

Low‑ and informational‑level findings are abundant but less actionable for immediate remediation, and therefore are not detailed here.

Who’s leading

Among the cohort, three startups stand out with top‑grade results:

• BaseFrame – Grade A
• Brumby (formerly GrazeMate) – Grade A
• Lexius – Grade A

These companies have achieved the highest composite scores, reflecting comparatively stronger security configurations across the evaluated dimensions.

What this means

The snapshot above offers a diagnostic view of the Winter 2026 Y Combinator cohort’s web‑security health. While many startups share common gaps—most notably the lack of CSP and other protective headers—there are clear pathways to improvement that can be prioritized based on severity. Companies interested in a deeper dive should request their private, detailed report, which includes specific remediation guidance, asset‑level findings, and trend analysis over time. This isn’t a punitive scorecard; it’s a collaborative benchmark to help each founder harden their product’s attack surface as they scale.