Introducing Echo Commit: More resources for the people keeping open source secure

Today, we’re launching Echo Commit: a new program that provides open-source maintainers with funding and hands-on engineering support for the security work their projects need.

The idea behind it is simple. There are thousands of maintainers responsible for software that millions of developers and businesses depend on. At the same time, the security industry keeps getting better at finding problems in that software. Scanners continuously analyze code, security researchers uncover new classes of issues, and frontier models are making vulnerability discovery dramatically faster. That progress is important, but every new finding also creates work for someone else.

Finding a vulnerability doesn’t fix it. Someone still has to investigate it, reproduce it, understand the root cause, develop a patch, test it, review it, and ultimately get a release out. Very often, that work falls to open-source maintainers who are already balancing releases, bugs, features, community requests, and everything else it takes to keep a project moving. Our ability to find security problems has scaled dramatically. The resources available to the people responsible for fixing them haven’t scaled at the same pace.

We see this work firsthand at Echo. Our engineers spend their days investigating vulnerabilities in open-source software, developing and testing patches, and validating that those fixes don’t break the software people depend on. Echo Commit came from a simple question: what if we put more of those resources directly behind maintainers, too?

More time and more hands

Through Echo Commit, selected maintainers can receive funding for the time they spend on security and remediation work, hands-on support from Echo engineers, or both. The support depends entirely on what’s useful to the project. It could mean reproducing and investigating an issue, developing a candidate patch, adding test coverage, validating a fix, reviewing existing security-related pull requests, or helping work through a security backlog.

Maintainers decide where that support goes. We’re not there to tell people who know their projects better than anyone else how to run them. We’re there to give them more resources to do the work they already know matters.

That principle extends to how the entire program is structured. Echo is a commercial company, and we want maintainers to be able to accept support from Echo Commit without wondering what Echo expects in return. Participation doesn’t require anyone to use or evaluate Echo products, endorse Echo, give us influence over their roadmap, or work exclusively with us. Maintainers remain completely free to work with any other vendor, foundation, funder, or program.

The same applies to engineering contributions. Echo engineers work through each project’s normal processes, and maintainers can reject any contribution we make for any reason without affecting their funding. The project also retains control over vulnerability disclosure, including when an issue is disclosed, what an advisory says, and whether or how a CVE is requested. Echo and our customers don’t get early access to fixes developed through the program. The goal is to get those fixes upstream, where everyone who depends on the project can benefit from them.

What success looks like

We’ve also been deliberate about what we consider success. Echo Commit isn’t about finding the most vulnerabilities, opening the most pull requests, or generating impressive-looking numbers. None of those things necessarily make open source more secure.

What matters is whether the work actually makes it upstream. That’s why we’ll measure and publicly report the share of fixes Echo Commit works on that are merged and released, along with the median time from initial report to released fix. We’ll also report annually on the funding distributed, engineering hours contributed, participating projects that agree to be named, and what we learned – including what didn’t work.

We want Echo Commit to be useful to the people doing the work. If it gives maintainers more time to focus on security, takes meaningful work off their plates, and helps important fixes reach the community sooner, then it’s doing what we built it to do.

Apply to Echo Commit

Applications are now open for the first Echo Commit cohort. Selection will consider how widely a project is depended on, its current security workload, available maintainer capacity, and whether Echo’s engineering expertise can genuinely help.

You don’t need to be an Echo customer, your project doesn’t need to be part of Echo’s catalog, and you don’t need to come to us with a perfectly defined scope of work.

If you maintain an open-source project and there’s security work you wish you had more time or hands for, apply to Echo Commit.