// Application · About 5 minutes

Apply to Echo Commit

Tell us a little about your project, the security work you’re facing, and where additional resources could help.

You don’t need to have a defined scope of work before applying. Applications are reviewed in cohorts.

About you

About your project

We’re especially interested in where the project is used, what it supports, and its role in the broader open source ecosystem.

Security work and support

Where does your project face the biggest capacity constraints?

Select all that apply

What are you looking to gain from Echo Commit?
Does your project have a vulnerability disclosure policy?

Share any additional context about your project, maintainers, security workload, or how Echo Commit could help.

Program acknowledgment

By clicking submit, I acknowledge Echo's privacy policy and consent to being contacted by Echo.

* All fields are required unless marked optional.

Application
received

Thanks for applying to Echo Commit. Applications are reviewed in cohorts, and we’ll email you once yours has been reviewed.

Questions in the meantime? Reach us at [contact email].

Leave your application?

Your answers haven’t been submitted and will be lost if you close this window.

Securing the upstream.

Echo Commit supports open-source maintainers with funding and hands-on engineering capacity to strengthen the security of the projects we all depend on.

# For the love of open source

Maintaining the open source software others depend on takes countless hours. And as security demands grow, so does the workload.

Echo Commit helps lighten the load with funding for your time and hands-on engineering support - from investigating vulnerabilities and tackling backlogs to shipping fixes upstream.

# What Echo Commit provides

  • Funding for maintainer time

    Funding for maintainer time

    Get funding for your time spent investigating and remediating security issues, based on milestones you define.

    Funding for maintainer time

    Get funding for your time spent investigating and remediating security issues, based on milestones you define.

  • Engineering support

    Engineering support

    Leverage support from experienced engineers on the security tasks that require an extra set of hands - from vulnerability investigation to patch development, and so much more.

    Engineering support

    Leverage support from experienced engineers on the security tasks that require an extra set of hands - from vulnerability investigation to patch development, and so much more.

  • Help getting fixes upstream

    Help getting fixes upstream

    Get fixes developed, reviewed, and released upstream through your project's existing processes, keeping everything open source and under your project's license.

    Help getting fixes upstream

    Get fixes developed, reviewed, and released upstream through your project's existing processes, keeping everything open source and under your project's license.

# Your project. Your rules.

Supporting maintainers without creating obligations to Echo.

  • No exclusivity
Work with any other funder, vendor, foundation, or program at any time.

  • No required code acceptance
You can reject any contribution from an Echo engineer without affecting your funding.

  • No product endorsement
You’re never required to use, evaluate, promote, or endorse Echo.

  • No privileged access to fixes Echo customers don’t get patches, fixes, or advisories before your project’s users.

  • No roadmap or governance influence
Echo has no say in your project’s roadmap, governance, or release decisions.

  • No ongoing obligation
You can leave the program at any time with no further commitment to Echo.

Work with any other funder, vendor, foundation, or program at any time.

You’re never required to use, evaluate, promote, or endorse Echo.

Echo has no say in your project’s roadmap, governance, or release decisions.

You can reject any contribution from an Echo engineer without affecting your funding.

Echo customers don’t get patches, fixes, or advisories before your project’s users.

You can leave the program at any time with no further commitment to Echo.

# How it works

  • 01

    Submit your application

    Tell us about your project, its security workload, and where you need additional resources.

  • 02

    Define the engagement

    If selected, you decide what support would be useful – funding, engineering capacity, or both.

  • 03

    Collaborate together

    Echo engineers contribute through your project's existing processes and under your direction.

  • 04

    Ship upstream fixes

    The goal is a fix that's reviewed, merged, and released for everyone who depends on the project.

# Disclosure stays in your hands

Echo will respect your disclosure timeline and will not share vulnerability details publicly or with customers ahead of it. If your project has no disclosure policy, we’ll establish one together before work begins.

# Is this program right for you?

  • // Who it's for

    Echo Commit is intended for maintainers of open source projects where security work is competing with limited maintainer capacity.

  • // How we select

    Echo Commit is intended for maintainers of open source projects where security work is competing with limited maintainer capacity.

    • 01How widely the project is depended on
    • 02The project's current security backlog
    • 03Available maintainer capacity
    • 04Potential impact of Echo support

  • // What doesn't count

    Selection is not based on whether your project is used by Echo, appears in Echo's catalog, or has any existing relationship with Echo.

Stronger security starts upstream

A vulnerability is solved when the underlying issue is fixed, and that fix reaches the people who depend on the software. Echo Commit exists to help more of those fixes make it upstream.