Chase Lee

✽ Securing autonomy / fmr VP Product @TrustVanta / Founder @trustpage (acq Vanta), @Ambassador (acq West), @Fetchnotes (acq Drift)

[Chase Lee @_chaselee]

@RichardGuerre_ Can’t wait to use this

[Chase Lee @_chaselee]

@nbaschez @mulka I should be thanking you 🫡

[Chase Lee @_chaselee]

Nathan has always made great things and this is no exception. Been using for a while and it’s become a core component of my daily work.

[Nathan Baschez @nbaschez]

Introducing Roughdraft!

A new open source project designed to make collaboration with agents better.

The idea is to bring commenting and suggested changes to markdown (e.g. plan docs) in a nice interface.

Free, local, etc.

👉 https://t.co/J3YOOpL5ES 👈

[Chase Lee @_chaselee]

@mulka Does one very useful thing very well

[Chase Lee @_chaselee]

Go Blue!

[Michigan Men's Basketball @umichbball]

The Kings of College Basketball 〽️

[Chase Lee @_chaselee]

@yenkel @karrisaarinen One of the last things I do before putting up a PR is see how much code I can cut/simplify if for no other reason than to cut unhelpful context.

[Chase Lee @_chaselee]

@jonallie @pxue +1, resolving conflicts is an important moment to be an engineer looking at the code yourself. Sometimes they’re obvious and quick and an agent gets there just fine. Others can have you taking one step forward two steps back. Use a resolver agent and review its work carefully.

[Garry Tan @garrytan]

I am coming around to the fact that MCP, done right, can be magic.

[Chase Lee @_chaselee]

@yenkel @tfadell Yes and not many can afford the price of being slow - incredible (even if short) window for small teams to capitalize

[Chase Lee @_chaselee]

We haven’t considered reports and certs from Delve valid for several months. Meaning, if you used them to get a SOC 2 report, we do not look at you as having one. And if you got a 27001 cert, recertifications don’t count. You need to start the process over.

[Karun Kaushik @karunkaushik_]

There’s been a lot of allegations against Delve.

But we haven’t been able to share our side of the story until today due to ongoing cybersecurity and forensics investigations.

Maintaining customer trust is central to everything we do.

That said, we grew too fast and fell short of our own standard. To our customers, we deeply apologize for the inconveniences caused.

We take these allegations seriously and have made changes: a new auditor network, free re-audits and pentests for all customers, enhanced transparency in audit communications, and more.

However, we also want to set the record straight on the anonymous attacks.

The evidence we have points to a targeted cyberattack from a malicious actor, not a “whistleblower.”

We believe the attacker purchased Delve under false pretenses, exfiltrated internal company data, and used it to launch a coordinated smear campaign.

The posts rely on a mix of fabricated claims, cherry-picked screenshots, and stolen data taken out of context.

See the link in the comments for more details.

Delve was built to modernize compliance. We are not going anywhere and are committed to building what's next.

[Chase Lee @_chaselee]

@yenkel @tfadell 100% and if it’s a bigger org, that is a lot of change to manage in what looks to be a short period. New teams need to start this way.

[Chase Lee @_chaselee]

@yenkel @tfadell Yes. Anything else and you’ll be left behind - both the person wearing a single hat and the company operating with a hat per person model.

[Chase Lee @_chaselee]

Our team has been doing a few things to deal with increased review volume and it’s starting to work - our avg time to merge went down 41% last week.

We own user stories end to end (everyone is a FDE), read and understand code as it’s generated, and have hooks to inspect other in flight PRs as we create our own - conflicts are caught ahead of time and mitigated or noted in PR/ticket descriptions with context for quick resolution when the time comes.

We each have agents that watch for PRs requesting our review with reviewers assigned automatically on round robin with preference to who has recently touched or reviewed relevant code, and we have another set of agents to help resolve review comments and conflicts, which is where any prior conflict notes then get addressed.

It’s turning out to be a pretty simple, cheap, and effective setup.

[Chase Lee @_chaselee]

@united This is awesome! Might be enough to make the switch from @Delta

[Ryan @ohryansbelt]

Delve, a YC-backed compliance startup that raised $32 million, has been accused of systematically faking SOC 2, ISO 27001, HIPAA, and GDPR compliance reports for hundreds of clients. According to a detailed Substack investigation by DeepDelver, a leaked Google spreadsheet containing links to hundreds of confidential draft audit reports revealed that Delve generates auditor conclusions before any auditor reviews evidence, uses the same template across 99.8% of reports, and relies on Indian certification mills operating through empty US shells instead of the "US-based CPA firms" they advertise. Here's the breakdown:

> 493 out of 494 leaked SOC 2 reports allegedly contain identical boilerplate text, including the same grammatical errors and nonsensical sentences, with only a company name, logo, org chart, and signature swapped in
> Auditor conclusions and test procedures are reportedly pre-written in draft reports before clients even provide their company description, which would violate AICPA independence rules requiring auditors to independently design tests and form conclusions
> All 259 Type II reports claim zero security incidents, zero personnel changes, zero customer terminations, and zero cyber incidents during the observation period, with identical "unable to test" conclusions across every client
> Delve's "US-based auditors" are actually Accorp and Gradient, described as Indian certification mills operating through US shell entities. 99%+ of clients reportedly went through one of these two firms over the past 6 months
> The platform allegedly publishes fully populated trust pages claiming vulnerability scanning, pentesting, and data recovery simulations before any compliance work has been done
> Delve pre-fabricates board meeting minutes, risk assessments, security incident simulations, and employee evidence that clients can adopt with a single click, according to the author
> Most "integrations" are just containers for manual screenshots with no actual API connections. The author describes the platform as a "SOC 2 template pack with a thin SaaS wrapper"
> When the leak was exposed, CEO Karun Kaushik emailed clients calling the allegations "falsified claims" from an "AI-generated email" and stated no sensitive data was accessed, while the reports themselves contained private signatures and confidential architecture diagrams
> Companies relying on these reports could face criminal liability under HIPAA and fines up to 4% of global revenue under GDPR for compliance violations they believed were resolved
> When clients threaten to leave, Delve reportedly pairs them with an external vCISO for manual off-platform work, which the author argues proves their own platform can't deliver real compliance
> Delve's sales price dropped from $15,000 to $6,000 with ISO 27001 and a penetration test thrown in when a client mentioned considering a competitor

[Chase Lee @_chaselee]

@stripe The MCP transport is a great call. Nice ship!

[yenkel @yenkel]

https://t.co/3nuTjq3ny4

[yenkel @yenkel]

we are here

[Chase Lee @_chaselee]

@damianplayer Never more thankful to be 35 than this thread

[Chase Lee @_chaselee]

@cjc Linear is my most used MCP! Last 30 days: