GitHub 保障 67 個 AI 開源專案安全

• Three-week intensive security sprints conducted with participating projects to identify and remediate vulnerabilities • Implementation of hardened GitHub Actions pipelines for CI/CD security • Development and deployment of Software Bill of Materials (SBOMs) including dependency license information[2] • Integration of CodeQL static analysis, with 500+ CodeQL alerts fixed in the last six months[1] • Deployment of secrets detection and prevention mechanisms, blocking 66 secrets in recent months[1] • Use of fuzzing techniques combined with AI-assisted code analysis to identify vulnerabilities faster[2] • Establishment of incident response plans and improved security reporting processes across participating projects[2]

The GitHub Secure Open Source Fund represents a structural shift in how critical infrastructure security is funded and maintained. By investing $1.38M across 138 projects with 219 maintainers in 38 countries, the initiative demonstrates that security in open source requires sustained institutional support rather than volunteer effort alone[1]. The integration of AI security tools into the program signals that maintainers must now defend against both human and AI-enabled threats, raising the baseline security requirements for projects underpinning the AI stack. This model may influence how other platforms and organizations approach open source security funding, particularly as AI-generated code contributions increase (currently 1-2% of commits but growing)[5]. The emphasis on measurable outcomes and systemic risk reduction across the global software supply chain suggests future funding models will prioritize quantifiable security improvements over process compliance.