Seventy one maintainers from 22 countries, half a million dollars and a few weeks. Ninety two per cent come out with core protections switched on.
In short
- GitHub reported the fourth session of its fund for open source security.
- 533 new vulnerabilities were found and disclosed, and 4,210 code scanning alerts were fixed.
- Since the start, 188 projects and 290 maintainers have been through it, with $1.88 million in total.
Seventy one maintainers from 22 countries went through training and turned up 533 new vulnerabilities. The code everything else stands on is usually guarded by two people nobody sees - and the bill always arrives at their door.
The facts: GitHub reported the fourth session of its open source security fund: 50 projects, 71 maintainers from 22 countries and over $500,000 distributed through GitHub Sponsors. 92% of projects finish with core platform protections enabled. 533 new vulnerabilities were identified and disclosed, over 1,500 security updates were made, over 650 exposed secrets were resolved, 4,210 code scanning alerts were fixed and 119 secrets were blocked before exposure. Since the start: 188 projects, 290 maintainers, 42 countries and $1.88 million.
533 vulnerabilities in fifty projects. Not because the people are weak, but because nobody had paid them to sit down and look.
Open source is free to use. Maintaining it never was.
And one honest note from them: AI helps you investigate and prioritise, but the context and the decision about what ships stay with the person. That is exactly how we work too.
The visual is generated code art. No third-party images.