Seventy one maintainers from 22 countries went through training and turned up 533 new vulnerabilities. The code everything else stands on is usually guarded by two people nobody sees - and the bill always arrives at their door.
Fact
The facts: GitHub reported the fourth session of its open source security fund: 50 projects, 71 maintainers from 22 countries and over $500,000 distributed through GitHub Sponsors. 92% of projects finish with core platform protections enabled. 533 new vulnerabilities were identified and disclosed, over 1,500 security updates were made, over 650 exposed secrets were resolved, 4,210 code scanning alerts were fixed and 119 secrets were blocked before exposure. Since the start: 188 projects, 290 maintainers, 42 countries and $1.88 million.
533 vulnerabilities in fifty projects. Not because the people are weak, but because nobody had paid them to sit down and look.
Open source is free to use. Maintaining it never was.
And one honest note from them: AI helps you investigate and prioritise, but the context and the decision about what ships stay with the person. That is exactly how we work too.
Official primary sources
GitHub Blog - What 50 open source projects taught us about security in the AI eraThe visual is generated code-art, no third-party images.