I ran YCombinator's Paxel under a live HTTPS wiretap. It sends your Cloudflare OAuth tokens, git email, and verbatim Claude prompts to YC servers
Source Reddit BlueTeam
Discussion
YCombinator's Paxel tool, which analyzes AI coding sessions, transmits sensitive user data including Cloudflare OAuth tokens, git email addresses, and verbatim user prompts sent to Claude's LLM proxy servers. This data transmission occurs even before the tool's Docker container starts and includes detailed behavioral reports with bash command histories. The tool strips file contents and LLM responses but sends user input prompts unaltered. This exposure was confirmed through live HTTPS interception and packet capture. The vendor has not provided a patch or official remediation guidance at this time.
r/Information_Security (opens in a new tab)u/Mindless_Clock_62990 points0 comments
Paxel is a new YC tool that analyzes your AI coding sessions (Claude Code, Cursor, Codex) and gives you a productivity report. The install is the classic `curl | bash` one-liner.
Before running it I built an HTTPS interception rig — custom Ruby SSL patch injected via Docker wrapper, full mitmproxy capture. Here's what a real run actually sends:
**The findings (all live-capture confirmed, not speculation):** I would request other researchers to do analysis as well.
🔴 CRITICAL — Cloudflare OAuth tokens (`cfoat_`) are NOT in the SecretScrubber's 22-pattern list. If you've ever run `wrangler deploy --api-token cfoat_...` in a Claude Code session, that token goes to YC's LLM proxy verbatim. Confirmed in the actual packet capture.
🟠 HIGH — Your git email is sent to `paxel.ycombinator.com/api/v1/identity/register` *before Docker even starts*, on every run, unconditionally.
🟠 HIGH — Everything *you typed to Claude* (user messages) goes verbatim to YC's LLM proxy. The tool strips Claude's responses and file contents — but your prompts, questions, and debugging thoughts are sent as-is.
🟡 MEDIUM — A 137KB behavioral report is uploaded per run: episode scores, LLM-generated session narratives, and a full timestamped list of every bash command you ran.
The meta moment: the session where I performed this analysis was itself captured by Paxel. The uploaded narrative read: "They specified that potential Wrangler OAuth token or Cloudflare deployment data exposure should be treated as a critical finding." YC received my security findings about their product in the results payload.
Full technical report, interactive data flow visualization, and raw capture analysis in the repo:
👉 https://github.com/trangocomputedev/ycombinator-paxel-security-analysis
Not saying Paxel is malicious — the TranscriptChunker v3 design (strips file contents and Claude responses) is genuinely thoughtful. But "analyzes your sessions" and "sends your prompts, bash commands, and email to third-party LLMs via a YC proxy and stores a behavioral profile" are usefully different descriptions.
I would also request other researchers to do analysis as well for validation.