The GitHub Secure Open Source Fund currently supports 188 open source projects across security tooling, AI/ML infrastructure, cryptography, developer productivity, and foundational libraries used by millions of developers and organizations around the world.

AI, machine learning, and intelligent systems

ACI.dev • ArviZ • AutoGPT/GravitasML • CAMEL-AI • Caracal • CocoIndex • CodeCarbon • Cognee • Deep Agents • DocsGPT • Jupyter • LadybugDB • LangChain • Matplotlib • n8n-MCP • Nasiko • Ollama • ONNX • OpenBB Platform • OpenClaw • OpenCV • OpenMetadata • OpenSearch • PageIndex • pandas • PyMC • Ruby-OpenAI • Scenic • SciPy • scikit-learn • Serena • TraceRoot • Zeus

Build systems, supply chain, and release tooling

Apache Airflow • Babel • Bluefin • bootc • Browserslist • Colima • Cucumber • CycloneDX Python Library • Flux • Foundry • Gitoxide • golangci-lint • GoReleaser • Jenkins • JReleaser • Jupyter Docker Stacks • NixOS/Nixpkgs • node-lru-cache • oapi-codegen • PostCSS • PyPI / Warehouse • rimraf • Task • Termux • Terra • Turborepo • Warpgate • webpack

Core programming languages, runtimes, and foundational libraries

Byte Buddy • core-js • CPython • FS2 • Gleam • Himmelblau • htmx • LLVM • Node.js • Pkl • Pyodide • Rustls • termcolor

Developer tools and productivity platforms

AirQo • API Dash • ArduPilot • AssertJ • AsyncAPI Initiative • Bevy • Bootstrap • calibre • Charset Normalizer • Cheerio • Ciphey • Cobra • CodeRunner • CSS Declaration Sorter • DataJourney • Diesel • DIGIT • Electron • ERPNext • fabric.js • Hoppscotch • ImageMagick • jQuery • jsoup • JUnit • libyt • LORIS • MapStruct • Mastodon • Mathesar • Mautic • Mermaid • MessageFormat • Mockoon • NativeScript • Next.js • Nuxt • nvm • Oh My Zsh • p5.js • Path-to-RegExp • Pelias Geocoder • Pillow • Polly • Proyecto Respira • PypeIt • python-benedict • qs • React Starter Kit • Readest • Resolve • Selenium • shadcn/ui • Sphinx • Spyder • ssh_config • Stirling PDF • Svelte • Thunderbird for Android • ToolJet • Two.js • Viper • Vuetify • Wagmi • WebdriverIO • xyflow • YAML • Yii Framework • Yjs

Web, networking, APIs, and infrastructure services

actix-web • aiohttp • Apache APISIX • Apache Solr • Apache ZooKeeper • Caddy • curl • CycloneDX cdxgen • CycloneDX .NET Library • Ente • etcd • evcc • Express • external-secrets • FastAPI • Fastify • Haraka • Helmet.js • Hummingbird • jose • Keycloak • Keyshade • kgateway • Log4j • mimetype • NetBird • Netty • OAuthlib • Oauth2 (Ruby) • PGPainless • quic-go • ScanAPI • ScanCode • Sniffnet • Social Auth App Django • Stalwart • Starlette • UAParser.js • urllib3 • Vapor • varlock • Veramo • WebAuthn (Go) • ZITADEL

• Log4j: We learned it the hard way: Ignorance is the biggest security hole. If this training had existed five years ago, maybe Log4Shell wouldn’t be here today.

• Turborepo: Secure Open Source Fund pushed us to specialize our IRP and ship it.

• shadcn/ui: Security went from something we should do to something we actively do.