Delve: A Series of Security Incidents and Scandals

The Delve Saga: A Series of Security Incidents

The startup Delve, specializing in compliance, is going through a tumultuous period marked by security incidents and compromising allegations. This once-promising company now finds itself at the center of controversies that highlight dubious practices and security flaws.

Recently, TechCrunch confirmed that Delve was responsible for the security certifications for Context AI, a startup developing artificial intelligence agents. Context AI revealed a security incident that led to a data breach at Vercel, a giant in application hosting. This event underscores potential vulnerabilities in security certification chains.

Consequences for Delve's Clients

Meanwhile, Lovable, another company that experienced a security incident, has decided to cease collaboration with Delve. This decision comes after Delve was accused of falsifying customer data and employing unscrupulous auditors. Although Delve has denied these accusations, the startup's reputation has been seriously tarnished.

A previous incident had already shaken Delve when LiteLLM, another client, fell victim to a hacker attack. The hackers managed to introduce malware into LiteLLM's open-source code. Following this incident, LiteLLM also ended its collaboration with Delve and initiated a new security certification process.

Controversial Practices and Consequences

Delve has also faced criticism for presenting an open-source tool as its own product, without adhering to the appropriate licenses. These practices led Y Combinator, a prestigious startup accelerator, to sever ties with Delve, further exacerbating the crisis of trust surrounding the startup.

Last weekend, Vercel suffered a breach of its internal systems. Hackers exploited the access of an employee who had downloaded an application developed by Context AI, linked to Vercel's corporate account hosted by Google. This incident highlights the risks associated with integrating new technologies without rigorous verification.

Reactions and Measures Taken

Following the attack on Vercel, Context AI confirmed that it had used Delve for its security certifications but has since changed providers. Context AI has transferred its compliance program to Vanta and engaged Insight Assurance for new audits. This decision aims to restore trust by strengthening the security of its processes.

Security certifications, while important, do not guarantee the absence of problems. They are designed to verify that companies have policies and processes in place to prevent attacks. However, as shown by Lovable's example, even with certifications, configuration errors can lead to data breaches.

Allegations of Controversial Spending

In parallel with the security incidents, Delve is facing new allegations from an anonymous whistleblower known by the pseudonym DeepDelver. This individual claims that Delve refuses to reimburse its clients while organizing a company trip to Hawaii for over 20 employees. Although TechCrunch has received credible evidence regarding this trip, other claims have not been verified.

Confronted with these multiple accusations and incidents, Delve has chosen not to comment on these new revelations. The current situation of the startup raises crucial questions about the reliability of security certifications and the integrity of business practices in the tech sector.