Open Source Runs on People, Not Just Code

The health of the software ecosystem depends on the humans maintaining it — often volunteers who triage issues after hours and respond to security reports from strangers. That workload has quietly become unsustainable. Maintainers are expected to review, merge, and ship while fielding a rising tide of automated pull requests and low-quality security reports. Burnout follows, and the rise of AI has intensified the pressure: vulnerabilities are discovered and exploited faster than ever, and those responsible for fixing them often lack the time or specialized knowledge to keep up.

GitHub's position is that supporting open source requires more than hosting repositories. It means equipping maintainers with tools, education, and direct funding so they can secure the projects the rest of the software world depends on.

A Joint Push to Fund Security Work

In collaboration with Anthropic, Amazon Web Services, Google, and OpenAI, GitHub has committed to a combined $12.5 million in grant funding for the Linux Foundation's Alpha-Omega initiative. The goal is twofold: help maintainers integrate emerging AI security capabilities into their existing project workflows and further advance open source security programs that target critical software projects.

That joint commitment builds on GitHub's existing support infrastructure. More than 280,000 maintainers across hundreds of millions of public repositories already qualify for free access to core GitHub services, including Copilot Pro, GitHub Actions, code scanning with Autofix, secret scanning, push protection, and dependency alerts. The GitHub Security Lab continues to publish advisories and educate the community on the most common threats. Two additional announcements extend that work:

  • The GitHub Secure Open Source Fund is adding $5.5 million in Azure credits and funding, alongside training and new partners including Datadog, Open WebUI, Atlantic Council, and OWASP.
  • GitHub Security Lab is investing in the security advisory experience and Private Vulnerability Reporting (PVR) features to filter out low-quality reports and ease the reporting burden on maintainers.

What Funding Shows About Fixing Security

The Secure Open Source Fund has already backed 138 projects with over 200 maintainers in 38 countries. The measurable impact includes 191 new CVEs issued, over 250 secrets prevented from leaking, and more than 600 leaked secrets detected and resolved — all in projects that account for billions of monthly downloads. The takeaway from that program is clear: maintainers act when they have both resources and room to learn. Linking funding directly to security outcomes, and pairing it with structured education, leads to fixes landing instead of accumulating.

That reinforcement loop — empowered maintainers producing more secure software that protects everyone downstream — is now the model guiding GitHub's next investments. The timing matters because generative AI has tipped the balance in both directions; projects that were never designated as critical infrastructure suddenly are, and maintainers are on the front lines against automated attacks.

AI Should Be a Force Multiplier, Not Another Burden

Logs, triage, and incoming pull requests already consume maintainers' attention. The advent of AI threatens to flood them with more noise, forcing them to sift through automated reports with weak signals. Log4j maintainer Christian Grobmeier's framing sets the bar: "our AI has to be better than the attacking AI." That is why GitHub's approach emphasizes not just detecting more vulnerabilities but helping maintainers triage, understand, and fix them without sacrificing the sustainability of their projects.

The recently open-sourced AI-powered security research framework is part of that philosophy — it is intended to equip maintainers, not just corporate security teams. GitHub has four goals as it refines these tools:

  • Meeting maintainers where they already work on GitHub
  • Helping prioritize actual issues over noise
  • Accelerating fixes, not just findings
  • Supporting secure defaults and healthy workflows

Maintainers of high-impact projects already have Copilot Pro, which includes AI-assisted code review, agentic security remediation workflows, and access to a range of leading models. The intent is to make AI reduce the workload — not add to it.

Shared Responsibility for the Software Supply Chain

No single company can secure open source alone. The code underwriting the global economy is built by a distributed community, and protection demands collaboration across ecosystems. Working with Alpha-Omega allows GitHub to scale impact through community governance while pairing it with its platform tools and AI-assisted capabilities. The stated priority remains consistent: investing in the people first, because open source thrives when maintainers are supported, respected, and given the space to do their best work.