Recently [Sniffnet](https://github.com/GyulyVGC/sniffnet) (a network monitoring tool I'm working on for more than 4 years) completed the [GitHub Secure Open Source Fund](https://github.com/open-source/github-secure-open-source-fund), a program focused on improving the security of widely used open-source projects.

The program consists of an immersive 3-week sprint that provides each onboarded project with $10k in funding, hands-on training, and mentorship to help maintainers understand that security is a baseline requirement, not a nice-to-have.

In a world where Murphy’s law reigns supreme (*“anything that can go wrong will go wrong”*), what we can do is be prepared for it: security planning and implementation is as important as the rest of development, and can’t be downgraded to a mere reactive countermeasure used only when things go sideways.

I feel a responsibility to amplify security awareness by sharing the knowledge and best practices I learned, so that other developers can take inspiration and apply similar proactive measures in their own projects: incident response planning, threat modeling, code scanning, and immutable releases are just some examples of the things that you can (and should) do.

I tried to collect and organize all the lessons I take home from the program in a blog post you can find [here](https://sniffnet.app/news/github-secure-open-source-fund/)



What I learned securing my project with the GitHub Secure Open Source Fund