Y Combinator Winter 2026

Overview

The Winter 2026 Y Combinator batch brings together 197 early‑stage startups, each navigating the twin pressures of rapid product iteration and growing security expectations. The aggregate security posture—averaging 64 / 100 with a median of 63—places the cohort squarely in the “C” range, indicating solid baseline practices but ample room for hardening. The most striking insight is the prevalence of missing security‑focused HTTP headers: missing Content‑Security‑Policy (CSP) headers appear on 160 of 197 sites, a signal that many teams are still prioritising functionality over defense‑in‑depth.

What we found

Critical and high‑severity gaps

Across the cohort we recorded six critical findings and 249 high‑severity issues. Although the raw count of high‑severity items dwarfs the critical ones, the critical findings are few enough to suggest they are isolated rather than systemic.

The dominant high‑severity problem is the absence of a Content‑Security‑Policy header. This header instructs browsers which sources of script, style, and other resources are trustworthy. Without it, 160 of the 197 scanned sites (detected 160 times in total) leave themselves open to cross‑site scripting (XSS) and data‑injection attacks that could be mitigated by a well‑crafted CSP.

A second, less common but equally important high‑severity gap is the missing Strict‑Transport‑Security (HSTS) header, found on 38 sites. HSTS forces browsers to use HTTPS for future connections, protecting users from downgrade attacks. The fact that nearly one‑fifth of the cohort lacks this header indicates that many startups are still in transition from HTTP to HTTPS‑only deployments.

Other high‑severity observations include:

• window.location assignments on 8 sites, which can be abused for open‑redirect attacks.
• Form submissions to external domains on 5 sites (detected 6 times), potentially exposing user data to third‑party collection points.
• Dynamic eval() usage on 5 sites, a JavaScript pattern that executes arbitrary code strings and is a known XSS vector.

These high‑severity issues are concrete, actionable items: adding CSP and HSTS headers, sanitising redirects, and avoiding eval() can dramatically improve the security baseline.

Medium‑severity trends (brief)

Medium‑severity findings were far more common, totaling 2,167 instances. The most prevalent were missing X‑Frame‑Options headers (138 sites) and dynamically injected script tags (116 sites, 475 detections). Both relate to click‑jacking and script‑injection risks, respectively, and can be mitigated with straightforward header additions and stricter content loading policies. Additional medium findings—such as public JavaScript source maps, permissive CORS (“*”) policies, and postMessage listeners without origin checks—underscore a broader need for developers to embed security considerations into their front‑end pipelines.

Low‑ and informational‑level observations were also recorded, but given the focus on actionable security posture, they are omitted here.

Who’s leading

Three startups stand out with top‑grade assessments: BaseFrame, Brumby (formerly GrazeMate), and Lexius each earned an “A”. Their scores suggest they have already implemented many of the recommended controls—such as CSP, HSTS, and secure framing—setting a benchmark for peers in the cohort.

What this means

The data presented offers a diagnostic snapshot of the Winter 2026 Y Combinator batch, highlighting both strengths and systemic gaps. Startups that appear in the high‑severity lists should treat the missing CSP and HSTS headers as priority remediation items; addressing these will move the cohort’s average score upward and reduce exposure to common web‑based attacks.

For a deeper dive—complete vulnerability details, remediation guidance, and comparative trends over time—each company can request its private report. This isn’t a punitive scorecard but a tool to help founders and engineering teams understand where their defenses stand today and how to build a more resilient product roadmap.