What I learned securing Sniffnet with the GitHub Secure Open Source Fund 🔒

[GyulyVGC]

Recently Sniffnet completed the GitHub Secure Open Source Fund, a program focused on improving the security of widely used open-source projects.

The program consists of an immersive 3-week sprint that provides each onboarded project with $10k in funding, hands-on training, and mentorship to help maintainers understand that security is a baseline requirement, not a nice-to-have.

In a world where Murphy’s law reigns supreme (“anything that can go wrong will go wrong”), what we can do is be prepared for it: security planning and implementation is as important as the rest of development, and can’t be downgraded to a mere reactive countermeasure used only when things go sideways.

I feel a responsibility to amplify security awareness by sharing the knowledge and best practices I learned, so that other developers can take inspiration and apply similar proactive measures in their own projects: incident response planning, threat modeling, code scanning, and immutable releases are just some examples of the things that you can (and should) do.

I tried to collect and organize all the lessons I take home from the program in a blog post you can find here.