OpenSSF

🎉 The 2025 OpenSSF Annual Report has officially arrived!!! We invite you to celebrate another year of progress, creativity, and collaboration shaping a safer, more resilient open source community. Download the report: #AnnualReport #OSSSecurity

🚨 New Tech Talk Alert 📅 Nov 2, 12 PM ET: Join OpenSSF to learn how an upstream-first strategy reduces tech debt & streamlines CRA compliance! Featuring experts from @LinuxFoundation, @ericsson, & @ActiveState. Read: Register:

💎 How do software attestations support due diligence? Eddie Knight explores how OpenSSF’s Gemara connects security policies, evaluations, enforcement, and audit evidence, with a practical look at CRA readiness. Read more:

Your Wednesday night #KubeCon plans? Sorted. Join OpenSSF + Defense Unicorns at ZarfFest for drinks, bites, and open source community. Nov. 11 | 6:30–9:30 p.m. Le Méridien, Salt Lake City Register:

OpenSSF just launched a new guide: Finding and Fixing Software Vulnerabilities Using AI, authored by David A. Wheeler. Learn how to prepare your setup, run AI effectively, and build deterministic safety nets for your code. Read & access the guide:

What happens when an AI agent can hide its tracks? @cra of @CloudNativeFdn joins @SecurityCRob to talk agents, disappearing evidence, and why independent observability matters. 🎧 New What’s in the SOSS?

From 1 ecosystem to 8. 🔐 GitHub expanded malware advisories using OpenSSF’s community-driven data, bringing broader coverage to developers with Dependabot malware alerts enabled. See shared security infrastructure in action:

Welcome Privateer to the OpenSSF Sandbox! 🎉 Privateer combines automated security checks with optional AI-assisted evidence review, flagging uncertain findings for human review. Explore the project and get involved:

Our new report, “Strengthening Software Supply Chain Security with OpenChain and OpenSSF,” explores how OpenChain's governance processes and OpenSSF's secure engineering practices work together.

🚀 The Fall Security Slam is live! Join the open source community October 5–November 6 to strengthen your project’s security, earn badges, and put OpenSSF best practices into action. All projects are welcome! 🎥 Learn how to get started with Eddie:

🎙️ From upstream projects to downstream products, how do we manage open source risk as the regulatory landscape changes? Vincent Danen joins What’s in the SOSS’ “Big Thoughts, Open Sources,”  to explore that question in our latest episode.

🎉 Welcome A-Team Systems, Emphere, DACHS IT GMBH, and JetBrains to OpenSSF! Live from #OpenSSFCommunity Day Europe in Prague, we’re sharing new members and CRA readiness resources to help strengthen open source security.

🇨🇿 Heading to Prague for #OSSummit? Don’t miss Adrianne Marcum and Christopher Robinson (CRob) for “AI Everywhere, Trust Nowhere? Navigating Open Source Security, ‘AI Slop,’ and the New Attack Surface.” Add it to your agenda:

September Newsletter is here! 📰 September brings a commitment to sustainable package registries, practical CRA guidance, new community security work, and more. Catch up on the latest OpenSSF updates:

Angie Jones VP at the Agentic AI Foundation, joins What's in the SOSS talking about what it actually takes to run AI agents in production. 🎧

Let’s keep the conversation going! ⚡ Join the #OpenSSFCommunity at #AGNTCon + #MCPCon North America. Explore the event and register here:

Heading to #KubeCon + #CloudNativeCon + Open Source #SecurityCon? Let’s connect at ZarfFest! 🎉 Join OpenSSF and Defense Unicorns for an evening of drinks, light bites, and great conversations with fellow builders, maintainers, and open source friends.

Open source participation creates business and career value. Explore @IBM’s journey with @RedHat and #ProjectLightwell, plus Jamie Thomas’s insights in conversation with CRob. What’s your strategy to give back?

Securing the open source supply chain is also about growing the community! 🌍✨ Discover how our talented mentees teamed up with seasoned mentors to tackle critical security challenges across projects in the OpenSSF Summer Mentorship Showcase.

Ready to level up your open source project’s security posture? 🛡️ OpenSSF & @CloudNativeFdn TAG Security launched Security Slam 2026 (Oct 5–Nov 6) for ALL OSS projects! Prepare for the EU CRA, access Slack advisors, and earn badges. Read the blog:

AI speeds up development. Can your security keep pace? ActiveState CEO Abby Kearns joins What’s in the SOSS? to tackle AI velocity, CRA compliance, and dependency debt. Know your dependencies. Hear her perspective. 🎧️