--- title: Inside GitHub's Secure Open Source Fund: what... description: GitHub's Secure Open Source Fund distributed over $500,000 across 50 open source projects in its fourth session, combining a three-week sprint, $10,000 grants,... canonical: https://daily.dev/posts/inside-github-s-secure-open-source-fund-what-maintainers-actually-got-out-of-it-5dxiszbpy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Inside GitHub's Secure Open Source Fund: what maintainers actually got out of it | daily.dev og:description: GitHub's Secure Open Source Fund distributed over $500,000 across 50 open source projects in its fourth session, combining a three-week sprint, $10,000 grants,... og:url: https://daily.dev/posts/inside-github-s-secure-open-source-fund-what-maintainers-actually-got-out-of-it-5dxiszbpy og:image: https://api.daily.dev/og/posts/5DXISzbPy.png og:image:alt: Inside GitHub's Secure Open Source Fund: what maintainers actually got out of it og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Inside GitHub's Secure Open Source Fund: what maintainers actually got out of it **[Collections](https://daily.dev/sources/collections)** · 3 min read · 2 upvotes · 0 comments ## Summary GitHub's Secure Open Source Fund distributed over $500,000 across 50 open source projects in its fourth session, combining a three-week sprint, $10,000 grants, Azure credits, and a 12-month follow-up with GitHub Security Lab office hours. Participants including LangChain, FastAPI, htmx, and Gleam used the time to write incident response plans, audit CI/CD workflows, and document security policies, with several experimenting with AI tools like Copilot for vulnerability triage and threat modeling as an accelerant rather than a decision-maker. Gleam's sprint found no vulnerabilities but delivered external validation of its existing practices, formalized security documentation, and an unplanned outcome: security expert John Downey joined Gleam's core team afterward. Gleam also clarified that using AI tooling during the sprint doesn't change its no-AI-contribution policy for code. Applications for Session 5 close August 24. ## Content GitHub's Secure Open Source Fund put over $500,000 into 50 open source projects during its fourth session, pairing maintainers with security experts, tooling, and a bit of funding to see what actually moves the needle on project security. The structure: a three-week sprint, a 12-month follow-up engagement, $10,000 per project, some Azure credits, and ongoing office hours with GitHub's Security Lab. Projects ranged from OpenClaw and LangChain to FastAPI, htmx, and the Gleam programming language. ## What the money and time went toward Most participating projects used the sprint to build things they'd been putting off for years: incident response plans, CI/CD workflow audits, security policy documentation. Several teams also experimented with AI tools, including GitHub Copilot, for vulnerability triage and threat modeling. The consistent finding across projects was less about AI being magic and more about it being a decent accelerant. It helped maintainers sift through alerts faster and sketch out threat models they wouldn't have had time to write from scratch. But nobody's handing off the actual decision-making. Maintainers still have to sign off on what ships, and that accountability didn't move an inch just because a model helped write the first draft. ## Gleam's experience: validation more than discovery Gleam's team went into the program already running a tight ship, and the sprint didn't turn up any vulnerabilities. That's not really a knock on the program, though. The value for them was elsewhere. Having outside security experts confirm that existing practices held up gave the team something concrete: not new fixes, but external validation they could point to. They also used the opportunity to formalize and publish security policies and compliance documentation, the kind of paperwork that's easy to skip until someone asks for it and then becomes a scramble. One unexpected side effect: John Downey, one of the security experts involved, ended up joining Gleam's core team afterward. That's the kind of outcome you can't really plan for in a program design document, but it's arguably one of the best possible ones. Gleam's writeup also included a clarification worth noting: exposure to AI-based tooling during the training doesn't change the project's existing no-AI-contribution policy. Using AI-assisted workflows to think through security posture during a funded sprint is a different thing than accepting AI-generated code into the project, and Gleam wanted to be clear those aren't the same decision. ## The bigger picture A quieter theme running through multiple projects' reflections: a lot of the open source software everyone depends on is maintained by people who are underfunded and stretched thin. A $10,000 grant and three weeks of expert attention isn't going to fix that structurally, but it's a real, if small, acknowledgment of the problem — and for some maintainers, it's the first time anyone's paid this kind of focused attention to their project's security posture at all. Applications for Session 5 close August 24, for anyone maintaining a project that could use the same kind of outside eyes. ## Questions this post answers ### What does GitHub's Secure Open Source Fund actually give to participating open source projects? Each participating project receives a three-week security sprint, a 12-month follow-up engagement, a $10,000 grant, some Azure credits, and ongoing office hours with GitHub's Security Lab. The fourth session funded 50 projects with over $500,000 total, including LangChain, FastAPI, htmx, and Gleam, pairing maintainers with outside security experts for audits, incident response planning, and policy documentation. _daily.dev surfaces programs like this for maintainers weighing how to fund and secure their projects._ ### Did Gleam's security sprint with GitHub find any vulnerabilities? No vulnerabilities turned up during Gleam's sprint; the value instead came from external validation that its existing security practices held up, plus newly formalized and published security policies and compliance documentation. An unplanned outcome followed: security expert John Downey, who worked with the team during the sprint, later joined Gleam's core team. _daily.dev helps maintainers track how peer projects like Gleam approach security audits._ ### Does using AI tools for security work change Gleam's policy on AI-generated code contributions? No, Gleam clarified that exposure to AI-based tooling during its GitHub-funded security sprint does not change its existing no-AI-contribution policy. Using AI-assisted workflows to think through security posture is treated as a distinct decision from accepting AI-generated code into the project's codebase. _daily.dev keeps developers current on how open source projects like Gleam draw the line on AI contributions._ ## Similar posts on daily.dev - [Securing the AI software supply chain: Security results across 67 open source projects](https://daily.dev/posts/securing-the-ai-software-supply-chain-security-results-across-67-open-source-projects-akkukhsvk) · GitHub Blog · 0 upvotes · 0 comments - [AI Companies Put $12.5M Into Open Source Security to Fix a Problem Their Tools Helped Create](https://daily.dev/posts/ai-companies-put-12-5m-into-open-source-security-to-fix-a-problem-their-tools-helped-create-fqepn8wn7) · It's Foss · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source), [#github](https://daily.dev/tags/github), [#gleam](https://daily.dev/tags/gleam) [View this post on daily.dev](https://daily.dev/posts/inside-github-s-secure-open-source-fund-what-maintainers-actually-got-out-of-it-5dxiszbpy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Inside GitHub's Secure Open Source Fund: what maintainers actually got out of it","url":"https://daily.dev/posts/inside-github-s-secure-open-source-fund-what-maintainers-actually-got-out-of-it-5dxiszbpy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/inside-github-s-secure-open-source-fund-what-maintainers-actually-got-out-of-it-5dxiszbpy"},"datePublished":"2026-08-17T19:18:51.558Z","dateModified":"2026-08-17T19:19:37.012Z","description":"GitHub's Secure Open Source Fund distributed over $500,000 across 50 open source projects in its fourth session, combining a three-week sprint, $10,000 grants,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/02f13bf398981fd6255e2e271c7a0010?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/02f13bf398981fd6255e2e271c7a0010?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/inside-github-s-secure-open-source-fund-what-maintainers-actually-got-out-of-it-5dxiszbpy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,open-source,github,gleam","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Inside GitHub's Secure Open Source Fund: what maintainers actually got out of it"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/inside-github-s-secure-open-source-fund-what-maintainers-actually-got-out-of-it-5dxiszbpy#faq","mainEntity":[{"@type":"Question","name":"What does GitHub's Secure Open Source Fund actually give to participating open source projects?","acceptedAnswer":{"@type":"Answer","text":"Each participating project receives a three-week security sprint, a 12-month follow-up engagement, a $10,000 grant, some Azure credits, and ongoing office hours with GitHub's Security Lab. The fourth session funded 50 projects with over $500,000 total, including LangChain, FastAPI, htmx, and Gleam, pairing maintainers with outside security experts for audits, incident response planning, and policy documentation. daily.dev surfaces programs like this for maintainers weighing how to fund and secure their projects."}},{"@type":"Question","name":"Did Gleam's security sprint with GitHub find any vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"No vulnerabilities turned up during Gleam's sprint; the value instead came from external validation that its existing security practices held up, plus newly formalized and published security policies and compliance documentation. An unplanned outcome followed: security expert John Downey, who worked with the team during the sprint, later joined Gleam's core team. daily.dev helps maintainers track how peer projects like Gleam approach security audits."}},{"@type":"Question","name":"Does using AI tools for security work change Gleam's policy on AI-generated code contributions?","acceptedAnswer":{"@type":"Answer","text":"No, Gleam clarified that exposure to AI-based tooling during its GitHub-funded security sprint does not change its existing no-AI-contribution policy. Using AI-assisted workflows to think through security posture is treated as a distinct decision from accepting AI-generated code into the project's codebase. daily.dev keeps developers current on how open source projects like Gleam draw the line on AI contributions."}}]} ```