Question 1

Why are we launching this program?

Accepted Answer

We ran an experiment in the GitHub Accelerator to determine whether providing time, resources, expertise, and engagement could enhance security awareness and adoption. The program included modular courses, expert speakers from leading tech companies and CISA, and collaboration with the GitHub Security Lab, resulting in an increase in the adoption of security best practices and features. Building on this success, we are launching a new security-focused programmatic open source fund to advance this work.

Question 2

What does the program entail?

Accepted Answer

The program is a 3 Week Security Education Program where GitHub provides operational resources and support for the funders. The projects invited into the program will receive programmatic security education, engagement with security experts. Projects will also gain benefits from the security focused maintainer community and promotion of projects and maintainers. Projects will also receive bi-annual security health check ins, and incident response support and emergency escalation path.

Question 3

What projects are best fit for this?

Accepted Answer

This program is suited for individual maintainers or small teams of open source projects. Teams that can benefit from education and community to tackle security in a scaled manner are welcome to apply.

Question 4

What role do Ecosystem Partners play in the GitHub Secure Open Source Fund?

Accepted Answer

Ecosystem Partners bring vital expertise from their work in open source security and sustainability, helping shape the program's direction. They contribute to program design, curriculum, and success metrics, connecting us with their networks to identify where support is most needed. Through regular check-ins, these partners share insights, provide feedback, and guide security improvements across the ecosystem. Contact us to become an Ecosystem or Funding Partner.

Question 5

Who can apply?

Accepted Answer

Anyone who is a current maintainer of an open source project. You can also apply as a team for a given open source project (max of 2 people).
You must also:

Be age eighteen (18) or older
Have an active online profile on GitHub
Be located in one of the regions supported by GitHub Sponsors
Not be a current employee of GitHub and/or any of its parent/subsidiary companies
Clear open source license
Open source first project with demonstrated community traction and adoption
Clear governance structure prior to kick-off
Interest and willingness to engage and improve security
Commitment from core leaders to participate in and engage in the required programming
Agree to Code of Conduct and Privacy Statement

Question 6

How are projects identified and selected?

Accepted Answer

Founding funding members will be able to take part in referring projects to the program. GitHub will also invite other projects and maintainers of important, fast growing projects to apply to the program.

Question 7

How are projects selected?

Accepted Answer

Projects will be evaluated upon the program and funding ability to impact security.

Question 8

What's the funding amount?

Accepted Answer

It is $10,000 per project.
All funding goes directly to the maintainers that are invited into the program. The funding is broken into tranches aligned to program schedules: $6,000 during program, $2,000 at 6 month check-in, and $2,000 at 12 month check-in.

Question 9

How can I apply?

Accepted Answer

Submit an application at https://forms.cloud.microsoft/pages/responsepage.aspx?id=v4j5cvGGr0GRqy180BHbR72dY7PBsFZJkFTETCg9J0xUNDdPUUU2S1pXTjFUOFMwNExEMzk5T1IxQi4u&route=shorturl

Question 10

What happens after I apply? What are the next steps? When should we hear back?

Accepted Answer

Applications are open on a rolling basis and will be considered for all Program Sessions. Selected participants will have a virtual interview to determine next steps.

Question 11

What do I get if my project is selected?

Accepted Answer

Funding: $10,000 per project in funding aligned with the program outcomes
Education: 3 week program: 5-10 hours of instruction, workshops and project-specific security milestones
GitHub Security Lab: Office Hours with the GitHub Security Lab team to establish effective security policies
Engagement: Q&As with GitHub Sponsors funders, community members, and GitHub leaders.
Expertise: Access to security experts, Q&As with GitHub Sponsors funders, community members, and GitHub leaders.
Tools: Free access and training for relevant GitHub products, including tools like GitHub Copilot and AutoFix
Cloud Credits: $10,000 in Azure credits. Eligible projects have potential to receive up to $150,000 in free Azure infrastructure credits from Microsoft for Startups.
Community: Access to the new GitHub Secure OSS security community
Certification & Health Reports: Program Certification and bi-annual security health reviews
Incident Management: Planning and support guidance.

Question 12

What do I have to do if I'm selected?

Accepted Answer

Selected participants must be able to commit 15 hours over a 3-week period, including weekly instruction, workshops, and focused work toward project-specific security milestones. Meetings are scheduled in Pacific Standard Time. Participants must also be available to commit 2.5 hours at both the 6-month and 12-month check-ins, totaling 20 hours for the program overall.

Question 13

How can my organization contribute to the fund?

Accepted Answer

The minimum contribution is to fund one (1) project for $10,000. Please fill out the contact us form at https://forms.cloud.microsoft/pages/responsepage.aspx?id=v4j5cvGGr0GRqy180BHbR72dY7PBsFZJkFTETCg9J0xUOEVXVzFKUjk1M0ZaWFVZSTdZMU85MkRPSi4u&route=shorturl

Question 14

What benefits do funders receive from participating in the program?

Accepted Answer

Funders are able to refer projects into the program. After the project is admitted, the funder is able to benefit in the improved security education and outcomes from the maintainer and project. This includes added insights on project security status, and updates on consistent reporting aligned to the project check-ins. Contact us to become an Ecosystem or Funding Partner.

Question 15

What are the benefits when an organization funds?

Accepted Answer

Reduced Security Risk: Improved security outcomes
Awareness: Recognition for funding and securing open source
Insights: Insights on project security status
Consistent Reporting: Bi-Annual security reports

GitHub Secure Open Source Fund

Funding security where it counts

Enhanced open source security

Agile, effective funding model

Scaled ecosystem impact

Funding partners

Ecosystem partners

From the blog

What 50 open source projects taught us about security in the AI era

Securing the AI software supply chain: Security results across 67 open source projects

Securing the supply chain at scale: Starting with 71 important open source projects

Microsoft launches new European Security Program — Includes GitHub Secure Open Source Fund

Techcrunch: GitHub launches an open source fund with a focus on security

Announcing GitHub Secure Open Source Fund: Help secure the open source ecosystem for everyone

Frequently Asked Questions

Let's improve open source security for everyone