What 50 open source projects taught us about security in the AI era - The GitHub Blog

Try GitHub Copilot app

Attend GitHub Universe

Search

Gregg Cochran·@dubsopenhub

August 13, 2026

11 minutes

Share:

AI is changing the pace of open source development and the security challenges that come with it. Maintainers are reviewing unfamiliar contributions, managing new attack surfaces, and responding to vulnerabilities with limited time and resources.

Session 4 of the GitHub Secure Open Source Fund tested a practical response. The Secure Fund invested more than $500,000 across 50 projects , pairing maintainers with GitHub Security Lab experts, GitHub security tools, AI-assisted workflows, and a peer community.

One lesson emerged consistently: AI can help maintainers investigate, prioritize, and respond faster. Maintainers still provide the context, judgement, and accountability required to decide what ships.

OpenClaw was invited to participate in Session 4 because it is GitHub’s fastest-growing open source project, and its maintainers wanted to strengthen its security posture.

By the end of Session 4, OpenClaw developed an incident response plan, expanded its use of GitHub security tooling, audited its GitHub Actions workflows, and strengthened its processes for identifying and responding to security issues.

The maintainers shared:

OpenClaw’s experience reflects the broader story of Session 4. While the specific risks varied across the cohort, maintainers shared a consistent need: the knowledge, tools, and expert support to secure software as AI changed how they built it.

Across the program, maintainers turned that support into concrete security improvements. Projects strengthened established practices, prepared for emerging AI-related risks, and explored how tools like GitHub Copilot could support vulnerability triage, threat modeling, code review, and remediation.

The benefits extend beyond individual projects. When maintainers strengthen the security of widely used open source software, they help build a more resilient ecosystem for everyone who depends on it.

Session 4, by the numbers

50 projects

71 maintainers

22 Countries

$500,000+ in non-dilutive funding powered by GitHub Sponsors

92% of projects completed the program with core GitHub security features enabled–secret scanning, code scanning, protected branches, private vulnerability reporting, Dependabot

Learn more or enable these security features for your own project.

Security results across all sessions:

Across all GitHub Secure Open Source Fund Sessions and follow-up periods through August 2026:

188 projects and 290 maintainers have participated across 42 countries

GitHub, Microsoft, and external funding partners have contributed $1.88 million , distributed through GitHub Sponsors.

Participating projects have identified and disclosed 533 new CVEs, performed more than 1,500 Dependabot security updates, and resolved more than 650 exposed secrets.

During the last six months ending in July 2026, participating and Alumni projects fixed 4,210 CodeQL alerts and blocked 119 secrets from being exposed.

How the GitHub Secure Open Source Fund works

The GitHub Secure Open Source Fund links funding directly to measurable security outcomes. The program combines hands-on security education, direct engagement with GitHub Security Lab experts, and a trusted community where maintainers can work through security challenges with their peers.

Each session is a three-week sprint and engagement for a total of 12 months. Funding and participation are tied directly to outcome‑driven goals and verified security improvements.

The sprint is designed and curated by the GitHub Security Lab , and delivered by security experts from GitHub and our partners. The training is structured into different focus areas per week.

These include:

Foundations of open source security

Threat modeling and secure coding

AI security and vulnerability management

Throughout this program, each project receives $10,000 USD via GitHub Sponsors (which breaks down to $6,000 USD during the sprint and $2,000 USD at six- and 12-month security check-ins). Projects are invited to a new security-focused community and office hours with the GitHub Security Lab, which they can take advantage of during the full 12 months. They also receive security resources to immediately implement in their project and Azure credits for cloud infrastructure.

Learn more about the Secure Open Source Fund.

Apply for Session 5 of the GitHub Secure Open Source Fund before August 24.

Become a Funding or Ecosystem Partner of the GitHub Secure Open Source Fund.

Where security work happened in Session 4

Session 4 focused on improving security across the systems developers rely on every day. The projects below are grouped by the role they play in the software ecosystem.

AI, machine learning, and intelligent systems 烙

Caracal • Deep Agents • DocsGPT • LadybugDB •...