The Open Source Technology Improvement Fund is proud to share the results of our security engagement on Developing ECH for OpenSSL (“DEfO”). ostif.org/defo-audit-c... #OSTIF #DEfO #AdaLogics #7ASecurity #SovereignTechAgency

#KubeCon EU starts today and guess what? Our very own @suidpit.sh will be on stage with a panel about the @kubernetes.io Security Audit we performed during 2025 with the support of @ostifofficial.bsky.social! 🗓️ March 25 - 16:45 CET 📍 Hall 8 | Room F

The Linux Foundation Announces $12.5 Million in Grant Funding (via Alpha-Omega and @openssf.org) Anthropic, AmazonWebServices, GitHub, Google, GoogleDeepMind, Microsoft, OpenAI to Invest in Sustainable Security Solutions for #OpenSource

We are proud to announce our top 3 bugs of the year on our blog: ostif.org/bug-of-the-y... #OSTIF #BOTY #7ASecurity

Miss our last OSTIF meetup? You can catch the recording here of Robin David, Software Security Researcher and Research Lead at Quarkslab, presenting "Bitcoin Core Audit: From Static Review to Fuzzing — Inside Bitcoin’s Testing Infrastructure". www.youtube.com/watch?v=J1Y1... #OSTIF #bitcoin

ISC is pleased to announce the results of code audits for our Kea DHCP and Stork graphical management software projects! Thank you to @ostifofficial.bsky.social and the ICANN Grant Program for their support and assistance. Read more about the audits at www.isc.org/blogs/2026-t...

Don't miss tomorrow's OSTIF meetup with Robin David, Software Security Researcher and Research Lead at Quarkslab, presenting "Bitcoin Core Audit: From Static Review to Fuzzing — Inside Bitcoin’s Testing Infrastructure". luma.com/gjnorzq0 #OSTIF #OpenSource #bitcoin

OSTIF is proud to share the results of our security audit of Stork, an open source project developed by the Internet Systems Consortium (ISC) that acts as an administrative interface for monitoring, maintaining, and surveilling Kea servers. ostif.org/stork-audit-... #OSTIF #Stork #7ASecurity

We, like everyone else, couldn't look away from the Veritasium video on the XZ vulnerability. Watch the video here www.youtube.com/watch?v=aoag... to learn more details about this incredible story of open source security and community. #OSTIF #Veritasium #XZ

For the past 4 years, OSTIF has run a Managed Audit Program for the CNCF. We’ve audited 33 projects in that time, working with maintainers all over the world to reinforce the security health of cloud native open source for billions of end users. Read the full report here: ostif.org/cncfmanagedp...

Miss yesterday's amazing audit meetup "High Assurance Cryptography and the Ethics of Disclosure" w/ @nadim.computer ? Catch the video here www.youtube.com/watch?v=TdOX... Make sure you're subscribed for notifications of any new meetups! luma.com/ostif-meetups #OSTIF #meetup #audit

Join us next Wednesday for an OSTIF meetup with Robin David, Software Security Researcher and Research Lead at Quarkslab, presenting "Bitcoin Core Audit: From Static Review to Fuzzing — Inside Bitcoin’s Testing Infrastructure". luma.com/gjnorzq0 #OSTIF #OpenSource #bitcoin

Reminder: The Sovereign Tech Agency is gathering feedback from open source maintainers and contributors working with technology standards to inform the Agency's future work and new initiatives. ➡️ survey.sovereigntechfund.de/999999?lang=...

TODAY: Join my livestreamed talk on my Cryspen findings and ask me questions! 5:00pm Paris time, coordinated with @ostifofficial.bsky.social. Register here: luma.com/xc4yuezb?tk=...

Our work with @sovereign.tech over the past two years resulted in 9 published audits with 6 more underway. OSTIF doesn't take lightly the responsibility we feel to help make a more resilient and secure open source ecosystem. Read more in our 2 year report: ostif.org/sovereigntec...

RSVP fornext week's OSTIF meetup with Nadim Kobeissi, Senior Applied Cryptography Auditor at Cure53 presenting "High Assurance Cryptography and the Ethics of Disclosure". RSVPing adds the event to your calendar and lets us know you're coming! luma.com/xc4yuezb #OSTIF #OpenSource #disclosure

The Open Source Technology Improvement Fund is proud to share the results of our security audit of zlib. Thanks to the efforts of 7ASecurity and the Sovereign Tech Fund, this project underwent a holistic security review. See 🧵 below 👇 #OSTIF #7ASecurity #audit #zlib

Join us in 2 weeks on Wednesday, February 25th, for an OSTIF meetup with Nadim Kobeissi, Senior Applied Cryptography Auditor at Cure53 presenting "High Assurance Cryptography and the Ethics of Disclosure". #OSTIF #OpenSource #disclosure

I'm giving a talk soon about my Cryspen findings, in collaboration with @ostifofficial.bsky.social. Happening online, will be live-streamed. Register here: luma.com/xc4yuezb?tk=...

This month's Community Spotlight shines on Peter Hunt, Principal Software Engineer at Red Hat who has contributed to both of OSTIF's audits of CRI-O (cri-o.io). Come check out our interview! ostif.org/feb-2026-com... #OSTIF #Spotlight #RedHat

🆓 🎉 It's Free Open Source Software Month! Learn open source skills for FREE! From Linux fundamentals to Kubernetes, secure software, and emerging tech, check out Linux Foundation Education’s free learning library today: training.linuxfoundation.org/resources/ #OSS #CloudNative #Linux #Kubernetes

We couldn't have done it without: @sovereign.tech @cncf.io @lfenergy.bsky.social @aswf.io @quarkslab.bsky.social @shielder.com @trailofbits.bsky.social @openssf.org @opensource.org @puerco.mx @funnelfiasco.bsky.social @nadim.computer @adamshostack.bsky.social @openforumeurope.org and so many more!

Presenting our 2025 annual report! In our report, you’ll see that OSTIF's story and mission are intertwined. OSTIF will continue to fight for open source infrastructure and the privacy rights of users for as many decades as you’ll let us. Our statement and report link: ostif.org/2025-annual-...

Congratulations to the Scala team for securing investment in open source infrastructure with the @sovereign.tech! We're proud to contribute to this effort, and look forward to the future of Scala and this endowment's positive impact: scala-lang.org/blog/2026/01...

@lfenergy.bsky.social EVerest underwent a security engagement facilitated by us with auditing by @quarkslab.bsky.social. This holistic security work impacts millions of EV charging stations worldwide. Read more at our blog: ostif.org/everest-secu...

We conducted the first public third-party security assessment of EVerest, an open-source firmware stack for electric vehicle charging stations, deployed in hundreds of thousands of charging points worldwide. The audit was mandated by @ostifofficial.bsky.social 🙏 blog.quarkslab.com/everest-secu...

Having previously undergone an OSTIF security audit in 2022, Cloud Native Computing Foundation (CNCF) project CRI-O received another review in late 2025. Security auditing was performed by X41 D-Sec GmbH, and their report is available to read on our blog: ostif.org/cri-o-audit-...

Releasing today is our security audit of Internet Systems Consortium's Kea project. The project received holistic security improvements and recommendations from Ada Logics. Read more about the work performed and results to the project at our blog: ostif.org/kea-security...

OSTIF is proud to announce our membership in the Open Policy Alliance, an organization dedicated to the uplifting of open source in public knowledge and understanding! Excited to be involved in the Open Source Initiative's advocacy. Ready about it at the press release: ostif.org/ostif-joins-...

Sorry for the hiccup with our tag in the previous post! Our thanks again to @ostifofficial.bsky.social for their help with this important audit, which you can again read about in our blog post: blog.thunderbird.net/2025/12/thun...

We are building tech you can trust. Thank you to @ostifofficial.bsky.social and 7A Security for their collaboration on the security audit for Thunderbird Send, our end-to-end encrypted file transfer service (coming to everyone soon, open source now). blog.thunderbird.net/2025/12/thun...

Miss last week's amazing audit meetup about OpenEXR from Shielder? Catch the video here www.youtube.com/watch?v=3PmW.... Make sure you attend the live events if you want to participate in the Q&A, as those aren't recorded!

OSTIF is proud to announce our audit of Mozilla Thunderbird-Send, with auditing by 7ASecurity. Not yet publicly released, this project will eventually be used in Mozilla email and web browsers. Read about the work done to prepare and harden this project at our blog: ostif.org/thunderbird-...

If you haven't met the OSTIF community and me, they have a special introduction for you. Check out OSTIF's Meet the Community video to learn more about my professional experience and envisioned changes for the open source community. Thanks to the OSTIF team for the great intro! shorturl.at/q9J8R

cool folks doing cool stuff - do not miss out!

@shielder.com security researchers Davide and Pietro will be presenting on their audit of OpenEXR next Tuesday, 13:00 CST. Join to hear about how a team at the top of their game is auditing high-value targets used in a billion dollar industry. RSVP here: luma.com/ir16fuig

I had the opportunity to meet up with members of the Open Source Technology Improvement Fund (OSTIF) where we discussed the benefits and tradeoffs of publishing threat models. Grateful to engage with this awesome community! Check out the recording from the meetup! 👉 shorturl.at/6uKfu

Quarkslab engineers Robin David, Mihail Kirov and Kaname just completed the first public security audit of Bitcoin Core, led by @ostifofficial.bsky.social and funded by Brink.dev Details on the blog post: blog.quarkslab.com/bitcoin-core... Congrats to developers for such software masterpiece !

We've been a bit excited about this one. We are excited and honored to have partnered with Bitcoin, brink, Chaincode Labs, and @quarkslab.bsky.social to collaborate on a security audit of Bitcoin Core. This was Bitcoin Core's first external audit. Read more at our blog: ostif.org/bitcoin-core...

We are pleased to announce that the KubeVirt Security Audit report has been published, in collaboration with @quarkslab.bsky.social and @ostifofficial.bsky.social Check out our blog post for all the details: kubevirt.io/2025/Announc...

#KubeCon day 1 keynotes: Amir Montaziry from @ostifofficial.bsky.social talking about securing open source projects and an update on the @kubernetes.io audit which I helped out with along with @iainsmart.bsky.social

OSTIF is proud to announce that our audit of @kubevirt.bsky.social is now public! This would not be possible without the contributions of Quarkslab and the Cloud Native Computing Foundation. Read about the work on our blog: ostif.org/kubevirt-aud...

Amir and Derek present Reflections on 10 Years: Celebrating the Open Source Technology Improvement Fund next Thursday, November 6th 13:00 CST. Hear our friends and collaborators in discussion with us about our past, present, and future. RSVP here: luma.com/nudnh5sv

Boo! Publish your threat models! 👻 Does that scare you? Join us Wednesday, Oct 29th at 14:00 CT with @adamshostack.bsky.social, who will be presenting on why transparency isn't something to be frightened of. RSVP to add straight to your calendar: luma.com/6fvp6orm

Should we publish our threat models? I explore a different lens with OSTIF for how transparency can benefit everyone. Oct 29, 14:00 CT 👉 luma.com/6fvp6orm

On November 6th at 13:00 CST, we are hosting "Reflections on 10 Years with OSTIF." Not just a reflection, this is a summation of our past, present, and future. RSVP to tell us your OSTIF experience, join in the celebration, or just to see what special guests we have joining: luma.com/nudnh5sv

This week's blog is "OSTIF's Strategy Plan". No holds barred, it's complete transparency of what our goals for the next 3-5 years are. If you've got 5 minutes to spare on this autumn Friday, you'll be caught up: ostif.org/ostifs-strat...

The @ostifofficial.bsky.social recently completed a security audit of #OpenSSFScorecard. With support from the OpenSSF, this audit covered five core repositories and included threat modelling, manual code review, and fuzz testing. . Read to learn more:🔗 openssf.org/blog/2025/10...

Publish your threat models! Not convinced? I'll be hosting a talk with OSTIF on Oct 29 @ 2pm CT for you to ask me questions. Register now and have your questions, thoughts, and comments ready! luma.com/6fvp6orm

Join us October 29th at 14:00 CST for a meetup with @adamshostack.bsky.social! RSVP here: luma.com/6fvp6orm First Adam will present on threat models (he literally wrote *the* book on the subject) and a Q&A portion will follow. We look forward to him and our community connecting!