Karan Handa

Curious about education, growth and knowledge-sharing on a massive scale.
Engineer.

[Karan Handa @karan_cz]

@GergelyOrosz That company needs a reality-Czech 😂

[Karan Handa @karan_cz]

@Pragmatic_Eng @GergelyOrosz @KentBeck “That's a statement by someone who doesn't understand software engineering.”

I disagree. That’s a statement by someone trying to sell their product.

[Karan Handa @karan_cz]

@X360freak @tomwarren Copilot+PC was the new error of PC

[Karan Handa @karan_cz]

@GergelyOrosz I see your POV, but I have been fairly surprised by how many times Claude Code has pushed back on my approach esp when I’m over-engineering something. That said, it definitely caves faster than a peer engineer 🤣

[Karan Handa @karan_cz]

@FINALLEVEL @BobGolen

[Karan Handa @karan_cz]

@AdamCSharp That joke is transcendental ♥️

[Karan Handa @karan_cz]

@pjvann @GergelyOrosz That is an epic analogy

[Karan Handa @karan_cz]

@cjc

[Ryan @ohryansbelt]

Delve, a YC-backed compliance startup that raised $32 million, has been accused of systematically faking SOC 2, ISO 27001, HIPAA, and GDPR compliance reports for hundreds of clients. According to a detailed Substack investigation by DeepDelver, a leaked Google spreadsheet containing links to hundreds of confidential draft audit reports revealed that Delve generates auditor conclusions before any auditor reviews evidence, uses the same template across 99.8% of reports, and relies on Indian certification mills operating through empty US shells instead of the "US-based CPA firms" they advertise. Here's the breakdown:

> 493 out of 494 leaked SOC 2 reports allegedly contain identical boilerplate text, including the same grammatical errors and nonsensical sentences, with only a company name, logo, org chart, and signature swapped in
> Auditor conclusions and test procedures are reportedly pre-written in draft reports before clients even provide their company description, which would violate AICPA independence rules requiring auditors to independently design tests and form conclusions
> All 259 Type II reports claim zero security incidents, zero personnel changes, zero customer terminations, and zero cyber incidents during the observation period, with identical "unable to test" conclusions across every client
> Delve's "US-based auditors" are actually Accorp and Gradient, described as Indian certification mills operating through US shell entities. 99%+ of clients reportedly went through one of these two firms over the past 6 months
> The platform allegedly publishes fully populated trust pages claiming vulnerability scanning, pentesting, and data recovery simulations before any compliance work has been done
> Delve pre-fabricates board meeting minutes, risk assessments, security incident simulations, and employee evidence that clients can adopt with a single click, according to the author
> Most "integrations" are just containers for manual screenshots with no actual API connections. The author describes the platform as a "SOC 2 template pack with a thin SaaS wrapper"
> When the leak was exposed, CEO Karun Kaushik emailed clients calling the allegations "falsified claims" from an "AI-generated email" and stated no sensitive data was accessed, while the reports themselves contained private signatures and confidential architecture diagrams
> Companies relying on these reports could face criminal liability under HIPAA and fines up to 4% of global revenue under GDPR for compliance violations they believed were resolved
> When clients threaten to leave, Delve reportedly pairs them with an external vCISO for manual off-platform work, which the author argues proves their own platform can't deliver real compliance
> Delve's sales price dropped from $15,000 to $6,000 with ISO 27001 and a penetration test thrown in when a client mentioned considering a competitor

[Karan Handa @karan_cz]

@maithra_raghu

[Karan Handa @karan_cz]

@diptidesaisf @hkarthik @linear 🤯 And I thought we were friends!!! 😱

JK JK! Now I’m curious about your thoughts on @linear

[Karan Handa @karan_cz]

@bubbleboi @grok Can you provide some context here?

[Karan Handa @karan_cz]

@hkarthik @tunguz @grok Is this true?

[Shreyas Doshi @shreyas]

It is overthinking if it’s recycling the same thoughts, it is not overthinking if it’s new thoughts and more correct thoughts when correctness matters.

[Adam Cochran (adamscochran.eth) @adamscochran]

Honestly insane how many of these tier 1 backed VC companies have the same story:

-cofounders from some prestige background sell VCs on some pie-in-the-sky concept that no one wants
-raise $100m+
-hire random roles like a chief AI officer for a non-AI startup
-have 0 users
-exit via OTC deals becoming a multi-millionaire
-“step back” right before vesting renews

IP protocol made $24 in revenue yesterday.

The pitch has also never made sense to anyone who has actually worked with IP licensing.

Meanwhile founders who know their industry inside and out, aren’t flash in the pan and spent decades in their field get passed over for the next Stanford kid with buzzwords who puts on a show.

I’ve tried to always have my angel checks go to actual experienced operators, with all the pros and cons that go with it.

But it’s so disheartening that even the “top VCs” just seem stuck on this loop of rewarding flash over substance.

How the hell do we advance as an industry, if you throw money at smoke, mirrors and grift?

[Karan Handa @karan_cz]

@Enola_guy12 X auto-translated for me 😔

[Karan Handa @karan_cz]

@thedarshakrana @grok Have you ever seen anything more ridiculous than this thread?

[Karan Handa @karan_cz]

@RhysSullivan

[Karan Handa @karan_cz]

@Abiy13335762 @elonmusk Epic