Security

NebuSec

Website
Founded 2026Origin source ↗Checked 2026-09-15

Overview

NebuSec is founded by the world’s #1 hacking team.

We were the first team to build an nginx RCE and the first to root Android 17. Our co-founders include members of the world’s No. 1 CTF team, DEF CON winners, Black Hat speakers, and PhD in cybersecurity. We have won $400K in bug bounties by exploiting the Linux kernel and Chrome browser.

“Audited by NebuSec” is a mark of serious security credibility: a signal to customers, investors, and partners that your product has been reviewed by the world’s best hackers.

Company description As recorded 2026-11-08
LinkedIn About
SecurityAI agentBusinessesEnterpriseSubscription

Founders & team

Previously Nebula Security

Company history As recorded 2026-11-08

Eten Zou

Founder/CEO

CEO & Founder @ Nebula Security (YC S26). PhD in Cybersecurity. Focus on automated vulnerability research.

LinkedIn X
Founder profile As recorded 2026-09-15

Yuan Tan

Founder/CTO

Founder at Nebula Security (YC S26). Black Hat USA speaker. PhD dropout in System Security with experience in DARPA-funded fundamental research on program analysis.

LinkedIn
Founder profile As recorded 2026-09-15

Frank Wu

Founder/Security Research Lead

Founder of Nebula Security (YC S26). Black Hat USA speaker and DEF CON finalist with r3kapig, the world's No. 1 hacking team in 2025. He led the DARPA AIxCC automated program repair team and shipped end-to-end RCE/LPE exploit chains on Chrome, Firefox, Linux, and Android. He pwned Google's kernelCTF multiple times with zero-days, and has published research at top academic venues such as USENIX Security and NDSS. Ph.D. dropout.

LinkedIn X
Founder profile As recorded 2026-09-15

Xiaochuan Yu

Founder/VP of Vulnerability Research

Founder at Nebula Security (YC S26). Hacked into iPhone, Chrome, Firefox, Safari, QEMU, and various things in your daily life. DEFCON finalist for 3 consecutive years. $200k+ Bug Bounty in Chrome. Core member of r3kapig, the #1 hacking team in the world in 2025, on CTFTime. M.S. from UC San Diego. Research published at USENIX Security, BlackHat USA. Ph.D. droped out.

LinkedIn X
Founder profile As recorded 2026-09-15
4team members reported
Source-reported As recorded 2026-09-15

Founded 2026 · Source

News & product activity

Sources & observations

Y Combinator

Profile depthverified profile
Website observationwebsite reachable
Last website check2026-11-11
Location · source statedSan Francisco, CA, USA; Remote
Pricing evidenceNo pricing page confirmed
Maturity: Not assessed · 3 of 6 areas documented

Source-based assessment · automated evidence rules

The homepage contains prelaunch or closure language; availability needs review.

Maturity is an evidence-based assessment, not a success rating. It may understate the current stage where evidence is limited. Coverage records documented areas, not a complete or independently audited company history.

Stage definitions
independent websitesource corroborationreachable websitedescriptive evidenceclassified market and modelsourced peoplesourced founding year
startup.observe Directory coverage · Sources & method