Securing the supply chain at scale: Starting with 71 important open source projects

GitHub’s Secure Open Source Fund (launched Nov 2024) provides maintainers with a three‑week sprint and 12‑month engagement to harden security across critical open-source projects; in the first two sessions, 125 maintainers from 71 projects remediated 1,100+ vulnerabilities, issued 50+ CVEs, prevented 92 new secret leaks (and resolved 176), and widely enabled GitHub security features. Projects spanning AI/LLM tooling (Ollama, AutoGPT/GravitasML), front-end frameworks (Next.js, shadcn/ui), servers/gateways (Node.js), DevOps tooling (Turborepo, Flux), security and supply-chain libraries (Log4j, CycloneDX), developer utilities (Charset-Normalizer, nvm, JUnit), and scientific computing (Matplotlib, Jupyter) implemented CodeQL scanning, fuzzing, hardened GitHub Actions and tokens, MFA, artifact/signature attestation, incident response plans, and threat models—showing measurable ecosystem risk reduction and momentum ahead of Session 3 in Sept 2025.