Hardening the open source foundation
When the Log4j zero-day broke in December 2021, the entire industry absorbed the same lesson: a single under-resourced library can send shockwaves through the entire software supply chain. With the average cloud workload now containing over 500 dependencies — many maintained by unpaid volunteers — the need to support and secure this ecosystem has never been more pressing.
GitHub launched the Secure Open Source Fund in November 2024 to address this head-on. The program pairs maintainers with financial support and a three-week intensive covering security education, mentorship, tooling, certification, and a community of security-minded peers. By tying funding to concrete security outcomes, the goal is to drive measurable risk reduction across the ecosystem at scale.
Early results from the first two sessions — which brought together 125 maintainers from 71 important and fast-growing open source projects — show tangible impact:
- Remediated over 1,100 vulnerabilities detected by CodeQL, reducing risk surfaces.
- Issued more than 50 new Common Vulnerabilities and Exposures (CVEs), informing and protecting downstream dependents.
- Prevented 92 new secrets from leaking, and detected and resolved 176 leaked secrets.
- 100% of participants left with actionable next steps for the following year's roadmap.
- 80% of projects enabled three or more GitHub-based security features.
- 63% reported a better understanding of AI and MCP security.
Maintainers also found inventive ways to use AI in their security work — many consulted GitHub Copilot for vulnerability scanning, security audits, and defining fuzzing strategies. Session 3 begins in September 2025, with a focus on bringing in maintainers working deeper in the dependency tree. Here's what changed inside the code categories that power nearly everything we build.
AI and ML frameworks and LLM tooling
Projects like Ollama, AutoGPT/GravitasML, scikit-learn, OpenCV, CodeCarbon, Zeus, Cognee, CAMEL-AI, and Ruby-OpenAI form the backbone of current AI development — LLMs, agents, orchestration layers, and model toolchains. They rack up tens of millions of installs and clones monthly, and are baked into cloud environments like Jupyter, Google Colab, AWS SageMaker, and Microsoft Azure ML. A prompt-injection flaw or poisoned model file here could spill into thousands of downstream applications overnight.
Ollama, which makes running LLMs locally feasible, took the opportunity to threat-model every component in its pipeline — GitHub Actions usage, DNS security, model distribution, engine execution, auto-update checks, and more — then pruned unused dependencies. "The GitHub Secure Open Source Program is a safe space to ask leading experts security questions, and learn how other high-impact projects address similar challenges," the team noted.
GravitasML by AutoGPT, an MIT-licensed XML parser for LLMs, wired CodeQL into every pull request across the AutoGPT Platform, built a lightweight "security agent" that coaches contributors as they code, overhauled its security policy, established a formal incident-response workflow, and mapped out 28 follow-up tasks ranging from fuzzing to completing the OSS Scorecard.
Front-end and full-stack frameworks
Frameworks like Next.js, Nuxt, Svelte, NativeScript, Bootstrap, shadcn/ui, Path-to-RegExp, and WebdriverIO ship the interfaces users touch — and often bundle server-side routing. Their install bases number in the millions. Bootstrap alone powers nearly 17.5% of the world's websites, and Next.js drives frontends for Notion and Adobe, among many others.
shadcn/ui, the React component library trusted by organizations like OpenAI, audited every GitHub Actions workflow and secret, refreshed its SECURITY.md, licenses, and dependencies, and developed threat models based on how malicious actors might attack the project. Enabling CodeQL caught an unsafe dangerouslySetInnerHTML path on the first scan. The team then used GitHub Copilot to implement fuzz testing. As they put it: "Security went from something we should do to something we actively do."
Web servers, networking, and gateways
Node.js, Express, Fastify, Caddy, and Netbird sit beneath most traffic on port 443. Hardening these projects protects the cookies, auth headers, and JSON payloads crossing the wire. Node.js alone underpins most server-side JavaScript workloads.
During the sprint, the Node.js security working group revamped its threat model and opened a pull request to integrate CodeQL into core, backed by a workflow that automatically reviews code scanning alerts and flags ambiguous errors for refactoring. Combined with planned signature checks on future releases, these upgrades ripple across every serverless function and server-side rendering setup shipping Node binaries.
DevOps, build-system, and container tooling
Tools like Turborepo, Flux, Colima, bootc, Terra, Warpgate, NixOS/Nixpkgs, Termux, and BlueFin touch every commit and deployment. An attacker who lands here owns the pipeline: Flux manages thousands of production GitOps clusters, and Turborepo's build cache accelerates builds at Vercel and other organizations.
Turborepo enabled GitHub private vulnerability reporting, tightened overly permissive workflow tokens, shipped a production-ready incident response plan, and now scans every pull request with CodeQL. These guardrails protect the Rust-powered build cache that thousands of monorepos rely on. The team is drafting a public threat model and provider-notification playbook to handle future zero-days quietly.
Security frameworks, identity, and compliance tooling
The locks, ledgers, and audit logs of the internet live in projects like Log4j, ScanCode, CycloneDX (cdxgen and cyclonedx-dotnet), ScanAPI, OAuthlib, PGPainless, Zitadel, Veramo, Stalwart, Social-App-Django, Jose, and Ente. CycloneDX SBOMs now appear in every major container registry; OAuthlib backs auth flows for Pinterest and Reddit; Zitadel issues millions of access tokens daily for European banks and healthcare platforms. Microsoft has also highlighted Log4J and ScanCode as critical elements across government and enterprise IT systems.
The Apache Log4j team hardened every GitHub Actions workflow against script injection, drafted a new threat model, and deepened collaboration across the open source community. Next up: bundling a CodeQL pack to flag unsafe logging patterns in downstream code and rolling out in-house fuzzing tests. Working with the ASF security team, their goal is to set a standard that ripples across many other ASF projects. "We learned it the hard way: Ignorance is the biggest security hole," the team said. "If this training had existed five years ago, maybe Log4Shell wouldn't be here today."
Beyond runtime libraries: Hardening the developer toolchain
Supply chain security work has historically concentrated on runtime libraries, but attacks on maintainers and the tools they depend on show that developer utilities deserve equal attention. These helpers run on laptops and CI nodes worldwide, and hardening them cuts off phishing routes and lateral-movement paths. Oh My Zsh alone has over 160,000 GitHub stars and executes every time millions of developers open a terminal.
The list of projects in this category spans Oh My Zsh, nvm, Cobra, Charset-Normalizer, Viper, API Dash, Stirling-PDF, Libyt, MessageFormat, YAML, qs, Polly, JUnit, CSS-Declaration-Sorter, Wagmi, Electron, and Resolve.
Charset-Normalizer
This 4,000-line encoding helper is downloaded roughly 20 million times per day on PyPI. During the sprint, its maintainer eliminated weak SMS 2FA in favor of passkey-based MFA, enabled GitHub secret scanning, and patched risky GitHub Actions that had gone unnoticed. SBOM generation is now being automated for every release, work that should soon make one of Python's most ubiquitous transitive dependencies audit-ready and CRA compliant.
A tiny library born out of a personal challenge will be CRA compliant amongst being one of the top OpenSSF scorecard projects.
nvm
The widely used Node version manager published its first incident-response plan and sketched a roadmap for a public vulnerability-disclosure policy, turning lessons from a recent audit into concrete guardrails. For the first time, its maintainer also learned how to use Copilot for security guidance. Next up: custom CodeQL queries and fuzzing harnesses to stress-test nvm's Bash internals, with the playbook to be shared with sibling OpenJS projects like Express.
The Secure Open Source Program helped nvm validate our security practices, implement an IRP, and set clear fuzzing and custom CodeQL goals, while deepening collaboration across OpenJS maintainers.
JUnit
Over the three-week sprint, JUnit rolled out end-to-end CodeQL scanning across all its repositories, fixing the first wave of findings. The project also formalized a public incident-response plan and locked down every workflow by switching GITHUB_TOKEN to explicit least-privilege permissions.
We immediately improved our GitHub Action's security, enabled MFA, and created an IRP.
Data, visualization, and scientific computing
Academic research, climate models, financial markets, and lab notebooks depend on this stack, where data integrity and traceability are non-negotiable. The category includes Matplotlib, Jupyter, Pelias Geocoder, Mathesar, DataJourney, AirQo, ERPNext, PypeIt, LORIS, Mautic, and Diesel. Jupyter Notebooks execute on more than 10 million cloud kernels per month, and Matplotlib charts appear everywhere from NASA publications to high-school science fair papers.
Matplotlib
The scientific Python staple tightened its GitHub Actions permission boundaries, reviewed and expanded SECURITY.md, and started a formal threat-modeling process that sparked immediate follow-up work. With OSS-Fuzz already catching crashes in its C extensions and an encrypted disclosure channel in progress, Matplotlib is turning unknown unknowns into a publicly available checklist other data-science projects can adopt.
The program reduced our uncertainty and gave us new tools to manage risk.
What actually moved the needle
- Money matters, but timeboxing matters more. The $10,000 USD stipend (about $500 per hour) helped maintainers focus, but the three-week cap kept momentum high. Several maintainers said a longer program would have been excessive.
- Focused themes and interactive coding drove quick adoption. Weekly security themes moved maintainers from theory to practice rapidly, letting them absorb concepts, experiment with real-time coding exercises, and enable security features with confidence.
- A security-focused community was the unlock. Fast rapport in Slack meant maintainers could ask critical questions on topics like supply-chain subpoenas and disclosure timelines, with some projects bringing urgent questions that couldn't be asked anywhere else.
Scaling security beyond a single sprint
Securing open source isn't a one-off effort or a badge of honor; it's baseline maintenance for the internet. With 71 heavily used projects receiving funding, three focused weeks, and direct help, maintainers shipped fixes that now protect millions of builds a day. The training model enables one-to-many impact: many maintainers are making their playbooks public, the incident-response plans they rehearsed are forkable, and the signed releases they now publish flow downstream to every package manager and CI pipeline that depends on them.
The effort drew on external support as well. In 2025 alone, the program received $1.38 million in commitments, credits, and contributions from funding and ecosystem partners.
The program is looking for maintainers managing critical projects, funding partners who recognize that prevention costs less than the next zero-day, and ecosystem partners with networks and insights to amplify the impact. Whether you write code, depend on open source, or simply want the software supply chain to remain stable, there's a role to play.
Projects & Maintainers: Apply now to the GitHub Secure Open Source Fund.
Funding and Ecosystem Partners: Become a Funding or Ecosystem Partner to support a more secure open source future.
