Free
the hunt, the retests and the signed evidence — funded by us, a few projects at a time
Private first
findings reach the maintainers before anything publishes
Named credit
the advisory carries the maintainers' names, on /advisories, after the fix
Who it is for
Three checks, all of them boring on purpose.
- →Openly licensed. A real OSI-style license in the repo — not a public repo with a proprietary license.
- →Actively maintained. Releases or commits within the last few months, and maintainers who respond. A project nobody tends cannot fix what we find.
- →Others build on it. The point of the program: a bug in something widely used is a bug in everyone who depends on it.
What it is not
- →Not an SLA. We hunt continuously, but response times are best-effort, in writing, honest.
- →Not a code audit. The hunt covers the running public web app and API, not the source tree.
- →Not for abandoned projects. If there is no one to fix the finding, the hunt has no point.
What the project gets
- 01
A continuous hunt on the project's public web app and API, inside a written scope — the same standing hunt commercial customers run.
- 02
Every finding validated with a working proof of concept, delivered privately to the maintainers with a concrete remediation.
- 03
A retest once the fix ships, so the advisory can say the bug is gone rather than was reported.
- 04
A published advisory, with the maintainers credited by name, once the fix is out and the wording is approved.
How it runs
- 01
Apply by email: project name, public URL, license, and who maintains it. We answer either way.
- 02
Scope agreed in writing before anything runs: which hosts, which techniques, the window, the no-gos. The same written authorization a paying customer signs.
- 03
The hunt runs. Findings land privately with the maintainers, proof of concept and remediation attached. Nothing publishes while the bug is live.
- 04
The fix ships, we retest, and the advisory publishes on /advisories with the maintainers' credit. Publication only happens with the maintainers' go-ahead.
How we run it (the operator playbook)
The program is run by the same rules as any engagement, in the open:
Eligibility check first
License, maintenance signal, public surface. Confirmed before any hunt is scheduled, and the answer is given either way.
Scope in writing, always
An allowlist of hosts and techniques, a test window, explicit no-gos. Nothing outside the written scope is touched — the same compliance gate that runs before a customer's hunt.
Private until fixed
Findings go to the maintainers only. Coordinated disclosure: the advisory is drafted after the fix, and the maintainers approve the wording before it publishes.
Capacity, stated honestly
A few projects run at a time — that is a real limit, not a marketing device. When the slots are full, new applications go on a list and are answered in order.
What maintainers ask first
What does it cost?+
Nothing. The hunt, the retests and the evidence are funded by us. The program exists because bugs in widely used open source are bugs in everyone who builds on it — and because hunting real projects keeps the pipeline honest.
Who sees the findings?+
The maintainers, first and only, until the fix ships. Findings arrive privately with a working proof of concept and a concrete remediation. Publication happens only after the fix, and only with the maintainers' approval of the wording.
What do you need from us?+
The public URL of the web app or API, the license, a written sign-off on the scope, and — if parts of the app need auth — a test account. Nothing internal, no source code, nothing beyond the written scope.
Do we have to publish an advisory?+
No. Publication is the default and the maintainers decide. If you would rather keep the finding private after the fix, that is respected — the credit line matters to us, your release policy matters more.
How is this different from a bug bounty?+
A bounty pays per finding and stops. This is the continuous hunt: it retests after every fix, watches the surface between releases, and stays on the project for as long as the program runs — with the same evidence discipline, in writing.