GitHub Secure Open Source Fund
Did you know that GitHub has a special program to fund security in open source? It's the GitHub Secure Open Source Fund. We were selected to participate in session 4 that happened in May 2026 and it was really special for us.
71 maintainers from 50 different open source projects and across 22 countries were selected to participate in the program. It was amazing to meet so many maintainers from other critical open source projects to learn how to make the open source software ecosystem more secure. We really acquired a meaningful amount of knowledge about security and had the enjoyed opportunity to ask questions and interact with both the GitHub Security Lab team and the other maintainers.
Some of the topics we learned about:
- How to make CI and GitHub Actions more secure
- How to handle dependency updates in a secure way
- How to handle vulnerability reports
- How to use tools like CodeQL to make code more secure
- How to better review code contributions to avoid introducing security issues
- Many more...
During the program we took action to make Task more secure, especially with regard to CI. Since then, we also handled a few different vulnerability reports, and having the knowledge to do that definitely helped us in the process.
We also formalized our security policies and documented them in a new security section of our website. See both our incident response plan and our threat model.
Many thanks to the GitHub Security Lab for this opportunity! Want to read more? GitHub wrote a blog post about session 4 that you can read here.