GitHub Secure Open Source Fund

GitHub’s Secure Open Source Fund combines maintainer funding with a security education and support program. Selected projects receive a $10,000 award per project, paid directly to maintainers through GitHub Sponsors, plus security guidance and cloud credits. This is funding tied to security work rather than an unrestricted recurring grant.

Eligibility and application. A current maintainer may apply alone or with one other team member. Applicants must be at least 18, have an active GitHub profile, live in a region supported by GitHub Sponsors, and not work for GitHub or a parent or subsidiary company. Projects need a clear open source license, demonstrated community traction and adoption, and a clear governance structure before kickoff. Core leaders must be willing to improve security and participate in the program, and applicants must agree to GitHub’s Code of Conduct and Privacy Statement. Submit the linked form; applications are considered on a rolling basis. GitHub says selected applicants have a virtual interview. Selection depends on the program’s assessment of the project’s potential security impact.

Funding and participation. The public FAQ specifies $10,000 per project, paid directly to its maintainers: $6,000 during the program, then $2,000 at the six-month and twelve-month security check-ins. Participants commit 15 hours over a three-week program and 2.5 hours for each follow-up check-in, 20 hours total. Other benefits include security training, GitHub Security Lab office hours, funder and expert Q&As, security community access, biannual health reviews, incident-response planning, relevant GitHub product access and training, and $10,000 in Azure credits. The page says eligible projects may have potential to receive up to $150,000 in additional Azure infrastructure credits through Microsoft for Startups; this is not guaranteed.

The page currently describes rolling applications, but it does not publish a response time, selection rate, detailed grant agreement, or credit expiration and usage terms. The application form is live but its questions were not readable through the text fetcher. GitHub reported 138 projects across Sessions 1–3 in February 2026; that historical figure is not an estimate of current availability.

See GitHub’s program page and FAQ, application form, and Session 3 results for current details.