Aakash Mahalingam helped push an enterprise product toward $20M ARR, then walked away to solve the part everyone skips. His startup, Canary, reads your source code so a broken checkout never reaches a customer.
There is a strange moment happening inside software teams right now. The code is getting written faster than anyone thought possible - a pull request that used to take a week now lands in an afternoon. And yet the thing that checks whether that code actually works still moves at the old speed. A human opens the diff, squints at a few files, and clicks approve. Aakash Mahalingam looked at that gap and decided it was a company.
He is the cofounder and CEO of Canary, a two-person startup in Y Combinator's Winter 2026 batch. The pitch is short enough to fit on a business card: AI writes your code, Canary tests it. Behind that line is a bet about where the industry is heading - that the bottleneck is no longer generating software, but trusting it.
To understand why Canary exists, it helps to sit where Aakash was sitting a year ago. At Windsurf, he built the enterprise product - the Applied AI tooling that wraps foundation models into something a Fortune-scale company can actually deploy. He watched the self-serve enterprise plan climb toward roughly $20 million in annual recurring revenue in about six months. From that seat, he had a clear view of what AI coding tools were doing to real teams.
They were making developers dramatically faster. And they were making pull requests dramatically bigger. Reviews, meanwhile, stayed exactly the same - a person reading a file diff, guessing at intent, hoping nothing important broke three screens away. Checkout. Authentication. Billing. The flows that quietly decide whether a business makes money.
The consequence shows up in a single uncomfortable number the founders keep pointing at: customer-facing incidents are up 43% year over year. More code, shipping faster, tested the same way it was a decade ago. Something had to give, and usually it gave in production, in front of a user, at the worst possible time.
Most automated QA tools try to understand your app from the outside. They scrape the DOM. They read screenshots. They watch pixels move and try to reverse-engineer what a button is supposed to do. It works until someone renames a class or nudges a layout, and then the whole brittle scaffolding collapses into a wall of false alarms.
Canary's contrarian move is to go the other direction. It reads the source code directly. When it connects to a codebase, it maps the routes, the controllers, the validation logic - the actual intent the developer encoded. When a pull request arrives, it reads the diff, interprets what the change is trying to do, generates end-to-end tests against a preview environment, runs them in real browsers, and posts the results, complete with recordings, right there on the PR.
It is deliberately unglamorous plumbing. The team built its own browser fleets, ephemeral environments, and data-seeding infrastructure - the kind of unsexy machinery that a foundation model, on its own, simply cannot provide. Canary spans several modalities at once: source code, DOM and ARIA labels, device emulation, visual verification, network logs. The point is not to pick one signal and trust it. The point is to triangulate the way a careful human tester would, only tirelessly and on every single pull request.
No brittle scripts. No manual QA. Just confidence on every deploy.
The clearest way to explain what Canary is for is a small story the team likes to tell. An early customer in construction tech had Canary watching their pull requests. It flagged an error in an invoicing flow - a bug that would have caused roughly $1,600 of drift - before the code ever shipped. No incident. No angry customer. No frantic Friday-night rollback. Just a comment on a PR that said, in effect, this number does not add up.
That is the whole thesis in miniature. The value of QA has never been in the tests themselves. It is in the failure you never see because it got caught in time. In a world where more code ships every day and each release touches money-moving flows, the cost of a missed bug goes up and the odds of catching it by hand go down. Aakash's wager is that this is not a niche pain. It is the natural, structural consequence of everything AI is doing to software development.
Aakash did not arrive at this problem by accident. The resume reads like a slow zoom into exactly the right vantage point. There was an ICPC APAC finalist run - the kind of high-pressure competitive programming stage where correctness under a clock is the entire game, which is a useful instinct for someone who would later obsess over whether code actually works. There were engineering stints at Amazon Web Services and Morgan Stanley, the schools of scale and the schools of things-must-not-break. There was a master's in computer science at Northeastern.
Then Windsurf, where the abstract future of AI tooling became a daily, revenue-bearing reality. He built for enterprises. He watched the ARR curve. And somewhere in there he saw the shape of the next problem before most people had finished celebrating the last one.
He is building it with cofounder Viswesh N G, who brings his own run through Google and Swiggy, working on maps and fraud detection - another domain where a quiet mistake becomes an expensive one. The founding team's collective time on AI coding agents at Windsurf, Cognition, and Google is the point, not the trivia. They have all lived on the generation side of this equation. They know exactly what it produces, and exactly what nobody was checking.
The company is legally Canaries, Inc., and the metaphor is doing real work. A canary was the thing that warned miners of danger before the danger could reach them - an early signal, a small life risked so larger ones would not be. A QA agent that comments on your pull request before the bad code reaches a customer is playing the same role, minus the tragedy. It sings when the air is fine and goes quiet when something is wrong.
There is something telling about a founder who leaves a fast-growing product not for a flashier one, but for the least glamorous corner of the stack. Testing does not trend. Nobody posts a demo of a bug that didn't happen. But that is precisely where Aakash Mahalingam decided the leverage was - in the widening gap between how fast machines can now write software and how slowly humans can still verify it. If he is right, the most valuable thing in the AI coding era won't be another tool that generates. It will be the one that quietly, relentlessly, checks the work.
For now it is two people, a browser fleet, and a very specific conviction: that confidence is the product, and everything else is plumbing.