Open Source Security Gets a Funding Model Tied to Results
Modern software—AI systems included—rests on an invisible layer of open source components. A single production service can depend on hundreds of transitive dependencies, and when one widely used project fails, the impact crosses registries, clouds, and downstream systems. The GitHub Secure Open Source Fund was built to address that systemic risk by linking funding to verified security outcomes, not just promises.
The model is straightforward: participating maintainers get non-dilutive funding, hands-on security training, and access to a community where they can surface high-risk concerns and get expert feedback. In exchange, projects must deliver measurable security improvements.
Session 3 Results
The third session of the program ran 67 projects with 98 maintainers and $670,000 in non-dilutive funding powered by GitHub Sponsors. Notably, 99% of projects completed the program with core GitHub security features enabled.
Across all three sessions, the cumulative numbers tell the story of security work at scale:
- 138 projects and 219 maintainers
- 38 countries represented
- $1.38M in non-dilutive funding
- 191 new CVEs issued
- 250+ new secrets prevented from leaking
- 600+ leaked secrets detected and resolved
- Alumni projects power billions of monthly downloads
In just the last six months, alumni projects also fixed 500+ CodeQL alerts and blocked 66 secrets from exposure.
Security Work Across the Ecosystem
Session 3 focused on the systems developers rely on daily, grouped by their role in the software stack.
Core Languages and Runtimes
This group includes CPython, Node.js, LLVM, Rustls, and related tooling that shapes how software is compiled, executed, and cryptographically secured. Improvements at this layer flow downstream to entire ecosystems.
CPython improvements, for example, directly benefit millions of developers using Python for application development, automation, and AI workloads. LLVM maintainers identified changes that complement existing investments and reduce risk across widely used toolchains.
Web, Networking, and Core Infrastructure Libraries
Projects like curl, urllib3, Netty, Apache APISIX, quic-go, and related libraries form the connective tissue of the internet, handling HTTP, TLS, APIs, and network traffic on the hot path of nearly every application.
Security fixes here have outsized impact because these components sit in the request path for countless production systems.
Build Systems, CI/CD, and Release Tooling
Compromising build tooling compromises the entire supply chain. Session 3 included Jenkins, Apache Airflow, GoReleaser, PyPI Warehouse, webpack, and related automation and release infrastructure.
Maintainers in this category focused on securing workflows that often run with elevated privileges and broad access. Improvements here help prevent tampering before software ever reaches users.
Data Science, Scientific Computing, and AI Foundations
Projects such as pandas, SciPy, PyMC, ArviZ, and OpenSearch participated in this session. These projects sit at the core of modern data analysis, research, and AI development, and are increasingly embedded in production pipelines.
Maintainers expanded security coverage across large, complex codebases—often moving from limited scanning to continuous checks on every commit and release. Many also engaged deeply with AI-related security topics, reflecting their growing role in AI workflows.
Developer Tools and Productivity Utilities
This group includes Selenium, Sphinx, ImageMagick, calibre, Spyder, and other widely used utilities found throughout development and testing environments. Improving security here reduces the risk that developer tooling becomes an unexpected attack vector, especially in automated or shared environments.
Session 3 also included projects like AssertJ, jQuery, jsoup, Mastodon, Mermaid, and the Yii framework, all of which shape the day-to-day experience of writing and maintaining software.
Identity, Secrets, and Security Frameworks
Participants such as Keycloak, external-secrets, oauth2 libraries, WebAuthn tooling, and related frameworks form the backbone of authentication, authorization, and secrets management.
Maintainers in this group often reported shifting from reactive fixes to systematic threat modeling and long-term security planning.
Security as Shared Infrastructure
One of the most durable outcomes of the program was a shift in mindset. Maintainers moved security from a stretch goal to a core requirement, and from reactive patching to proactive design. Many are now publishing playbooks, sharing incident response exercises, and passing lessons on to their contributor communities.
That is how security scales: one-to-many. When widely used open source projects harden their foundations, every system built on top of them inherits that resilience.
Scaling security skills across the open source ecosystem
The project treats security training as shared infrastructure. Rather than teaching one maintainer at a time, the program pairs 67 heavily used projects with funding and three focused weeks of direct help. The result: maintainers shipping fixes that today protect millions of builds daily.
The training itself comes from the GitHub Security Lab with help from outside security experts. Because the format emphasizes small-group instruction, the lessons extend beyond the sessions. Many maintainers are already making their playbooks public. The incident-response plans they rehearsed are forkable. The signed releases they now ship flow downstream to every package manager and CI pipeline that depends on them.
Two ways to get involved
The program is open to contributions from both sides of the ecosystem.
- Projects and maintainers: Apply to the GitHub Secure Open Source Fund. Session 4 begins April 2026.
- Funding and ecosystem partners: Organizations can join as a partner to support the mission of scaling software supply chain security.
Partners behind the effort
The program credits a wide network of participating organizations.
Funding partners: Alfred P. Sloan Foundation, American Express, Chainguard, Datadog, Herodevs, Kraken, Mayfield, Microsoft, Shopify, Stripe, Superbloom, Vercel, Zerodha, 1Password
Ecosystem partners: Atlantic Council, Ecosyste.ms, CURIOSS, Digital Data Design Institute Lab for Innovation Science, Digital Infrastructure Insights Fund, Microsoft for Startups, Mozilla, OpenForum Europe, Open Source Collective, OpenUK, Open Technology Fund, OpenSSF, Open Source Initiative, OpenJS Foundation, University of California, OWASP, Santa Cruz OSPO, Sovereign Tech Agency, SustainOSS
