When a startup I work for was borderline manipulated into onboarding onto the Carta platform [0], I did some brief security review. I noticed they’re loading t

When a startup I work for was borderline manipulated into onboarding onto the Carta platform [0], I did some brief security review. I noticed they’re loading third party JS with at least one postMessage handler with a wildcard origin. They were also sending the current page title (which can include things like company or investor name) to this provider. It appeared they were also using a version of Knockout.js that is 2+ years old. [1] This did not inspire a lot of confidence. The linked blog post at least takes security seriously, but it’s clear they’re patching over a lot of legacy cruft. There’s a hell of a lot of sensitive data on Carta, which I’m sure they’re already selling to their “partners” anyway, but IMO it’s only a matter of time before they (or one of their “partners”) are hacked and a whole bunch of companies suffer from information breach. IMO the main reason they haven’t been hacked yet is simply because you need to pay $2k just to get access to their questionably secure app. [0] Your lawyer tells you that you need a 409a and Carta is the best. But if you only want the 409A, and don’t want to get growth hacked onto Carta’s platform, you’re out of luck. They won’t do the 409A for you unless you complete the full onboarding process, which includes appointing Carta as your company’s transfer agent, and uploading the email addresses of your investors and allowing Carta to spam them with tasks like re-signing legal documents that you issued off-platform. [1] This is not a technical analysis and I’m just going by what I remember from watching my local chrome dev tools. Don’t @ me.