--- title: Help from the Github Security Lab | daily.dev description: The Gleam programming language project shares reflections after participating in the 4th GitHub Secure Open Source Fund, a program combining a 3-week security... canonical: https://daily.dev/posts/help-from-the-github-security-lab-pbl8kgolo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Help from the Github Security Lab | daily.dev og:description: The Gleam programming language project shares reflections after participating in the 4th GitHub Secure Open Source Fund, a program combining a 3-week security... og:url: https://daily.dev/posts/help-from-the-github-security-lab-pbl8kgolo og:image: https://api.daily.dev/og/posts/pBL8kgOLO.png og:image:alt: Help from the Github Security Lab og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Help from the Github Security Lab **[Gleam](https://daily.dev/sources/gleam)** · 5 min read · 0 upvotes · 0 comments ## Summary The Gleam programming language project shares reflections after participating in the 4th GitHub Secure Open Source Fund, a program combining a 3-week security training, a 12-month engagement for ongoing improvements, and $10,000 in GitHub Sponsorship funding. Gleam reports it was already in strong security shape before the program, uncovering no vulnerabilities, but found value in expert validation of its practices, in publishing security policies and compliance documentation to build user trust, and in recognizing that many open source dependencies are underfunded and understaffed. The team also notes that John Downey, a security expert, has since joined the Gleam core team, and clarifies that AI-based tooling covered in the training does not signal a change to Gleam's no-AI-contribution policy. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the GitHub Secure Open Source Fund provide to participating open source projects? It provides a 3-week security training program, a 12-month engagement for implementing ongoing security improvements, and $10,000 USD in GitHub Sponsorship funding. The Gleam programming language was selected for the 4th cohort of the program, which included 50 open source projects in total, and found no existing vulnerabilities during its security review. _Maintainers weighing how to fund open source security work can track programs like this on daily.dev._ ### Has the Gleam project found any security vulnerabilities in its codebase? No security vulnerabilities were found during Gleam's participation in the GitHub Secure Open Source Fund's security training and review process. The Gleam team credits this to prior hard work by contributors and collaboration with the Erlang Ecosystem Foundation, which meant many standard security practices were already in place before the program began. _Developers evaluating the security posture of language ecosystems can follow updates like this on daily.dev._ ## Similar posts on daily.dev - [Securing the AI software supply chain: Security results across 67 open source projects](https://daily.dev/posts/securing-the-ai-software-supply-chain-security-results-across-67-open-source-projects-akkukhsvk) · GitHub Blog · 0 upvotes · 0 comments - [AI Companies Put $12.5M Into Open Source Security to Fix a Problem Their Tools Helped Create](https://daily.dev/posts/ai-companies-put-12-5m-into-open-source-security-to-fix-a-problem-their-tools-helped-create-fqepn8wn7) · It's Foss · 0 upvotes · 0 comments - [GitHub will start paying some bug bounty hunters in swag instead of cash](https://daily.dev/posts/github-will-start-paying-some-bug-bounty-hunters-in-swag-instead-of-cash-aa2efuue8) · The New Stack · 0 upvotes · 1 comments - [GitHub scales back bug bounties, reminds users security is their responsibility too](https://daily.dev/posts/github-scales-back-bug-bounties-reminds-users-security-is-their-responsibility-too-5yjehso1r) · CSO Online · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#github](https://daily.dev/tags/github), [#gleam](https://daily.dev/tags/gleam) [View this post on daily.dev](https://daily.dev/posts/help-from-the-github-security-lab-pbl8kgolo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Help from the Github Security Lab","url":"https://daily.dev/posts/help-from-the-github-security-lab-pbl8kgolo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/help-from-the-github-security-lab-pbl8kgolo"},"datePublished":"2026-08-17T19:14:11.445Z","dateModified":"2026-08-17T19:19:20.947Z","description":"The Gleam programming language project shares reflections after participating in the 4th GitHub Secure Open Source Fund, a program combining a 3-week security...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/02f13bf398981fd6255e2e271c7a0010?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/02f13bf398981fd6255e2e271c7a0010?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Gleam","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Gleam","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/13aabbd66eb74f4b9dba15b15e80e16e","url":"https://daily.dev/sources/gleam"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/help-from-the-github-security-lab-pbl8kgolo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,github,gleam","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Gleam","item":"https://daily.dev/sources/gleam"},{"@type":"ListItem","position":3,"name":"Help from the Github Security Lab"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/help-from-the-github-security-lab-pbl8kgolo#faq","mainEntity":[{"@type":"Question","name":"What does the GitHub Secure Open Source Fund provide to participating open source projects?","acceptedAnswer":{"@type":"Answer","text":"It provides a 3-week security training program, a 12-month engagement for implementing ongoing security improvements, and $10,000 USD in GitHub Sponsorship funding. The Gleam programming language was selected for the 4th cohort of the program, which included 50 open source projects in total, and found no existing vulnerabilities during its security review. Maintainers weighing how to fund open source security work can track programs like this on daily.dev."}},{"@type":"Question","name":"Has the Gleam project found any security vulnerabilities in its codebase?","acceptedAnswer":{"@type":"Answer","text":"No security vulnerabilities were found during Gleam's participation in the GitHub Secure Open Source Fund's security training and review process. The Gleam team credits this to prior hard work by contributors and collaboration with the Erlang Ecosystem Foundation, which meant many standard security practices were already in place before the program began. Developers evaluating the security posture of language ecosystems can follow updates like this on daily.dev."}}]} ```