Cold outreach starts with a clean list. In one evening, using nothing but curl, I scraped every YC batch from the last two years: 1,546 companies, 3,034 founders, 99.4% LinkedIn coverage.

No headless browser. No paid API. No proxy pool.

The key discovery: the data is right there in the HTML

YC's company detail pages are rendered with Inertia.js, which embeds the full page data as JSON inside a data-page attribute. Which means:

curl -s https://www.ycombinator.com/companies/xxx \
  | grep -o 'data-page="[^"]*"' \
  | # HTML-entity decode → complete JSON

One pipeline, and you get the company profile, the founder list, and every social link. A lot of sites that look like they "need Playwright" have shortcuts like this — read the page source first, then decide whether to bring out the heavy machinery.

Three engineering decisions

  1. Batch isolation: ten batches, each with its own directory and its own checkpoint — one failing batch never touches the others
  2. If it can't be verified, mark it not-found: never pad the numbers. A real 99.4% LinkedIn coverage beats a fake 100%
  3. Machine data physically separated from human notes: refreshing the database can never clobber my handwritten follow-up notes

One trap: don't trust the tags

In the W26 and Sp26 batches, 80% of companies have no industry tags at all. Filter by the AI tag and you'll miss most of the real AI companies. The right move is running every company description through a classifier.

This list is now the first cornerstone of my outreach database, people.db. Next up: the 2,240 makers from Product Hunt.