Securing the upstream.

Echo Commit supports open-source maintainers with funding and hands-on engineering capacity to strengthen the security of the projects we all depend on.

# For the love of open source

Maintaining the open source software others depend on takes countless hours. And as security demands grow, so does the workload.

Echo Commit helps lighten the load with funding for your time and hands-on engineering support - from investigating vulnerabilities and tackling backlogs to shipping fixes upstream.

# What Echo Commit provides

  • Funding for maintainer time

    Get funding for your time spent investigating and remediating security issues, based on milestones you define.

  • Engineering support

    Leverage support from experienced engineers on the security tasks that require an extra set of hands – from vulnerability investigation to patch development, and so much more.

  • Help getting
    fixes upstream

    Get fixes developed, reviewed, and released upstream through your project's existing processes, keeping everything open source and under your project's license.

# Your project. Your rules.

Supporting maintainers without creating obligations to Echo.

  • No exclusivity
Work with any other funder, vendor, foundation, or program at any time.

  • No required code acceptance
You can reject any contribution from an Echo engineer without affecting your funding.

  • No product endorsement
You’re never required to use, evaluate, promote, or endorse Echo.

  • No privileged access to fixes Echo customers don’t get patches, fixes, or advisories before your project’s users.

  • No roadmap or governance influence
Echo has no say in your project’s roadmap, governance, or release decisions.

  • No ongoing obligation
You can leave the program at any time with no further commitment to Echo.

Work with any other funder, vendor, foundation, or program at any time.

You’re never required to use, evaluate, promote, or endorse Echo.

Echo has no say in your project’s roadmap, governance, or release decisions.

You can reject any contribution from an Echo engineer without affecting your funding.

Echo customers don’t get patches, fixes, or advisories before your project’s users.

You can leave the program at any time with no further commitment to Echo.

# How it works

  • 01

    Submit your application

    Tell us about your project, its security workload, and where you need additional resources.

  • 02

    Define the engagement

    If selected, you decide what support would be useful – funding, engineering capacity, or both.

  • 03

    Collaborate together

    Echo engineers contribute through your project's existing processes and under your direction.

  • 04

    Ship upstream fixes

    The goal is a fix that's reviewed, merged, and released for everyone who depends on the project.

# Disclosure stays in your hands

Echo will respect your disclosure timeline and will not share vulnerability details publicly or with customers ahead of it. If your project has no disclosure policy, we’ll establish one together before work begins.

# Is this program right for you?

  • // Who it's for

    Echo Commit is intended for maintainers of open source projects where security work is competing with limited maintainer capacity.

  • // How we select

    Applications are reviewed in cohorts, with selection based on:

    • 01How widely the project is depended on
    • 02The project's current security backlog
    • 03Available maintainer capacity
    • 04Potential impact of Echo support

  • // What doesn't count

    Selection is not based on whether your project is used by Echo, appears in Echo's catalog, or has any existing relationship with Echo.

Stronger security starts upstream

A vulnerability is solved when the underlying issue is fixed, and that fix reaches the people who depend on the software. Echo Commit exists to help more of those fixes make it upstream.