Security in the AI Era: Lessons from 50 Open Source Projects

AI accelerates open source development while creating new attack surfaces, posing security challenges. To address these changes, the GitHub Secure Open Source Fund invested over $500,000 in 50 projects during Session 4 to support enhanced security capabilities.

The core of this program is that AI helps maintainers speed up investigation, prioritization, and response times. However, final judgment and responsibility remain with human maintainers.

Participating projects achieved the following specific security improvements:

• Established incident response plans
• Expanded use of GitHub security tooling
• Audited GitHub Actions workflows
• Strengthened processes for identifying and responding to security issues

Looking at the overall program results, 188 projects and 290 maintainers have participated so far, with total funding exceeding $1.88 million. This has increased ecosystem-wide resilience by identifying 533 new CVEs and performing over 1,500 Dependabot security updates.

The program consists of a 3-week sprint and 12 months of participation, with each project receiving a $10,000 grant via GitHub Sponsors. Participating projects receive training from GitHub Security Lab experts along with specialized support in areas such as AI security and vulnerability management.