At Stack Auth, a Y Combinator backed open source company, a young software engineer’s code decides who gets into hundreds of applications. Anyone can read it.
Authentication is the software most companies refuse to write. The login screens, session handling, and permission systems that guard every application are notoriously easy to get wrong and catastrophic when they fail, which is why Verizon’s annual Data Breach Investigations Report has for years listed stolen credentials among the most common ways attackers get in. The standard advice to developers is blunt: do not build your own auth. The result is an industry where the most sensitive code in nearly every product is written by someone else, usually behind closed doors.
Stack Auth, a San Francisco company backed by Y Combinator, is part of a movement taking the opposite approach. Its authentication platform, covering user management, permissions, and multi-tenancy, is fully open source, and its repository has drawn several thousand stars on GitHub along with contributions from developers worldwide. Mantra Patel is one of the engineers responsible for that codebase, a role in which his work is not only used by other companies but read by them.
A Decade of Work, All of It Checkable
Mr. Patel, 22, has not yet completed his degree. While he remains enrolled in the mathematics and statistics program at the University of British Columbia, a detail that sits oddly beside his professional record. In 2021, he led a five person team operating game server infrastructure for RAWKNEE, one of India’s large gaming communities, scaling the system to a thousand concurrent players on limited hardware.
The budget constraint dictated the engineering: more capacity had to come from more efficient software rather than more servers.
“That was my first real production system,” he said. “A thousand players will tell you very quickly when something is slow. It taught me to think about capacity in code before thinking about capacity in dollars.”
In May 2023, while an undergraduate, he co-founded Scribs.ai and led development of its platform for about a year and a half, carrying the system from architecture through deployment. He then worked as a software engineer at mail0 on consumer email software before joining Stack Auth in San Francisco in March 2026.
Alongside the employment record runs an open source one. On GitHub, Mr. Patel has contributed code to widely used public projects including Hugging Face’s machine learning libraries, the tabler interface toolkit, the coqui text to speech engine, and the BentoML model serving framework. His own project, ManusMCP, which implements AI agent workflows using specialized planner, file, command, and web navigation agents, has been starred by dozens of developers and forked by others building on its design.
The Work at Stack Auth
At Stack Auth, Mr. Patel’s work centered on expanding authentication into a broader identity infrastructure platform. He worked on a backend rewrite from Next.js to ElysiaJS, first-party analytics and observability comparable in ambition to PostHog, Sentry, and Datadog, fraud detection for bots and free-trial abuse, and early machine-authentication work for services, agents, and other non-human actors. These are technically hard problems because they sit at the intersection of runtime architecture, security, telemetry, abuse prevention, and identity modeling: the platform must remain backward-compatible while changing its backend, observe auth behavior without weakening it, distinguish legitimate users from automated abuse, and model authentication for machines as rigorously as it does for people. The work was developed in Stack Auth’s public repository, giving the contribution a visible technical record.
The open source model also changes the day to day responsibility of the role. Part of Mr. Patel’s job is reviewing pull requests from outside contributors, code written by developers he has never met that, once merged, runs inside the security layer of every product built on the platform.
“Reviewing a stranger’s code for an auth system is a different discipline from reviewing a colleague’s,” Mr. Patel said. “You cannot rely on shared context. The code has to justify itself completely, and so does mine when the community reviews it back.”
Why It Matters Beyond One Company
The stakes of this way of working extend past Stack Auth. Harvard Business School researchers have estimated that replacing the open source software firms rely on would cost trillions of dollars, a measure of how much of the economy runs on code written in public by engineers who are rarely named. A mistake in a widely adopted authentication library does not stay inside one company; it propagates to everyone who builds on it. That asymmetry is why the review standards in open infrastructure projects are severe, and why the engineers who clear them are doing consequential work whatever their age.
Mr. Patel does not argue that openness solves security by itself. Open projects have shipped serious vulnerabilities, and transparency without scrutiny protects no one. His claim is narrower. “Closed software asks you to trust the vendor. Open software asks you to trust the code, and gives you the means to verify it,” he said. “The point is that it can be challenged. In authentication, that matters because trust without verification is exactly the thing you are trying to avoid.”
It is a fitting standard for an engineer whose career can be checked commit by commit: game infrastructure serving a thousand players before he left secondary school, a platform built end to end as an undergraduate co-founder, contributions to public projects used across the industry, and now the authentication layer that other companies trust with their front door. In a field where resumes are easy to inflate, Mr. Patel’s argument for himself is simply that the work is public.