GitHub joins the Open Source Security Foundation

Open Source Security Gets a Unified Industry Home

Open source components now underpin virtually every software project: 99% of codebases contain them, and the average repository carries more than 200 dependencies. That ubiquity brings agility and innovation, but it also means projects inherit risk and technical debt from every component they pull in. GitHub has spent the past few years building tools and programs to address that risk—acquiring Dependabot and Semmle in 2019 and making both security tools free for public repositories, while the GitHub Security Lab and the Open Source Security Coalition have driven discovery of over 120 CVEs in open source software.

Those efforts are now folding into a broader industry initiative. GitHub is joining the Open Source Security Foundation (OpenSSF) as a founding member, alongside Google, IBM, JPMorgan Chase, Microsoft, NCC Group, OWASP Foundation, Red Hat, and others. The OpenSSF itself brings together several existing efforts, including the Linux Foundation’s Core Infrastructure Initiative and the work of GitHub’s Open Source Security Coalition. The goal is a single, cross-industry home for open source security work.

From Coalition to Foundation

GitHub launched the Open Source Security Coalition less than a year ago with a mission to gather companies and organizations committed to securing open source software globally. It quickly attracted 21 founding members, including Google, HackerOne, IOActive, Mozilla, Microsoft, NCC Group, and Trail of Bits. The coalition ran active working groups focused on vulnerability disclosures, identifying threats to open source projects, best practices for developers, and security tooling.

With the move to OpenSSF, the coalition’s work and its lessons learned are being integrated into the foundation’s broader structure. The intent is to avoid duplicating efforts across the industry and give open source security a single, coordinated venue.

What Continues at GitHub

OpenSSF membership doesn’t replace GitHub’s existing security work. The GitHub Security Lab will continue to drive security research and bring researchers into the open source community. GitHub also remains committed to building new security features for developers and keeping them free for public repositories. As the host for more than 50 million developers, GitHub sees open source security as a shared responsibility—one it intends to keep investing in alongside the rest of the ecosystem.

More details are available on the OpenSSF site and in the organization’s GitHub repository.