GitHub Secure Open Source Fund

We ran an experiment in the GitHub Accelerator to determine whether providing time, resources, expertise, and engagement could enhance security awareness and adoption. The program included modular courses, expert speakers from leading tech companies and CISA, and collaboration with the GitHub Security Lab, resulting in an increase in the adoption of security best practices and features. Building on this success, we are launching a new security-focused programmatic open source fund to advance this work.

Anyone who is a current maintainer of an open source project. You can also apply as a team for a given open source project (max of 3 people). 

You must also:

• Be age eighteen (18) or older

• Have an active online profile on GitHub

• Be located in one of the regions supported by GitHub Sponsors

• Not be a current employee of GitHub and/or any of its parent/subsidiary companies

• Clear open source license

• Open source first project with demonstrated community traction and adoption

• Clear governance structure prior to kick-off

• Interest and willingness to to engage and improve security

• Commitment from core leaders to participate in and engage in the required programming

• Agree to Code of Conduct and Privacy Statement

You can submit an application here. 

• Funding: $10,000  per project in funding aligned with the program outcomes

• Education: 3 week program: 5-10 hours of instruction, workshops and project-specific security milestones

• GitHub Security Lab: Office Hours with the GitHub Security Lab team to establish effective security policies

• Engagement: Q&As with GitHub Sponsors funders, community members, and GitHub leaders.

• Expertise: Access to security experts, Q&As with GitHub Sponsors funders, community members, and GitHub leaders.

• Tools: Free access and training for relevant GitHub products, including tools like GitHub Copilot and AutoFix

• Cloud Credits: $10,000 in Azure credits. Eligible projects have potential to receive up to $150,000 in free Azure infrastructure credits from Microsoft for Startups.

• Community: Access to the new GitHub Secure OSS security community 

• Certification & Health Reports: Program Certification and bi-annual security health reviews

• Incident Management: Planning and support guidance.

We will evaluate applications on a rolling basis until they close January 7. Selected participants will have a virtual interview to determine next steps. If you do not hear back from us by Feb 15, 2024 you were not selected to participate.

It is $10,000 per project.

All funding goes directly to the maintainers that are invited into the program. The funding is broken into tranches aligned to program schedules: $6,000 during program, $2,000 at 6 month check-in, and $2,000 at 12 month check-in.

The program is a 3 Week Security Education Program where GitHub provides operational resources and support for the funders. The projects invited into the program will receive programmatic security education, engagement with security experts. Projects will also gain benefits from the security focused maintainer community and promotion of projects and maintainers. Projects will also receive bi-annual security health check ins, and incident response support and emergency escalation path. 

Selected participants must be able to commit 5-10 hours during the 3 week program of weekly instruction, workshops, and homework or focused work towards project-specific security milestones agreed between the project, the program managers, and GitHub Security Lab experts. All meetings will be hosted in Pacific Standard Time.

This program is suited for individual maintainers or small teams of open source projects. Teams that can benefit from education and community to tackle security in a scaled manner are welcome to apply. 

Founding funding members will be able to take part in referring projects to the program. GitHub will also invite other projects and maintainers of important, fast growing projects to apply to the program.

Funders are able to refer projects into the program. After the project is admitted, the funder is able to benefit in the improved security education and outcomes from the maintainer and project. This includes added insights on project security status, and updates on consistent reporting aligned to the project check-ins.

November 19, 2024

Projects will be evaluated upon the program and funding ability to impact security. 

The program kick-off will be in early 2025. 

The minimum contribution is to fund one (1) project for $10,000. Please fill out this contact us form. 

The first cohort will kick off in Q1 CY 2025, and the funding will commence from that schedule.

• Reduced Security Risk: Improved security outcomes

• Awareness: Recognition for funding and securing open source

• Insights: Insights on project security status

• Consistent Reporting: Bi-Annual security reports

Ecosystem Partners bring vital expertise from their work in open source security and sustainability, helping shape the program’s direction. They contribute to program design, curriculum, and success metrics, connecting us with their networks to identify where support is most needed. Through regular check-ins, these partners share insights, provide feedback, and guide security improvements across the ecosystem.

Awesome! Sign up here for updates.