Inside GitHub's Secure Open Source Fund: what maintainers actually got out of it

Each participating project receives a three-week security sprint, a 12-month follow-up engagement, a $10,000 grant, some Azure credits, and ongoing office hours with GitHub's Security Lab. The fourth session funded 50 projects with over $500,000 total, including LangChain, FastAPI, htmx, and Gleam, pairing maintainers with outside security experts for audits, incident response planning, and policy documentation. daily.dev surfaces programs like this for maintainers weighing how to fund and secure their projects.

No vulnerabilities turned up during Gleam's sprint; the value instead came from external validation that its existing security practices held up, plus newly formalized and published security policies and compliance documentation. An unplanned outcome followed: security expert John Downey, who worked with the team during the sprint, later joined Gleam's core team. daily.dev helps maintainers track how peer projects like Gleam approach security audits.

No, Gleam clarified that exposure to AI-based tooling during its GitHub-funded security sprint does not change its existing no-AI-contribution policy. Using AI-assisted workflows to think through security posture is treated as a distinct decision from accepting AI-generated code into the project's codebase. daily.dev keeps developers current on how open source projects like Gleam draw the line on AI contributions.