Show HN: Supply chain security for open source maintainers

Maintainers are now a prime target for malicious packages and hijacked dependencies. We give qualifying open source projects the full SafeDep Team plan for free, with 10 seats for your maintainers.

Open source is what everyone builds on. The people who maintain it deserve the same protection that large companies pay for.

Watch the story , so Astro's scoped class never lands on it. -->

Maintainers are the new target. Most have no security team.

Attackers publish lookalike packages, take over maintainer accounts and slip malicious code into dependencies. When one popular project is hit, everyone downstream is hit too. Most maintainers protect millions of users in their spare time.

No cut down edition and no feature gates. Approved projects get the same plan that paying teams use.

Malicious package protection

Every dependency is checked against SafeDep threat intelligence. Known bad packages are caught before they land in your project.

Pull request checks

The SafeDep GitHub App reviews new and changed dependencies on every pull request, so you never have to read a lockfile diff by hand.

Protection on maintainer machines

PMG blocks malicious installs on the laptops and CI runners your maintainers use, and syncs every event to your SafeDep tenant.

Policies and findings in one place

See findings across every repository in your project and set the rules once for all of them.

90 day history and audit trail

Look back at what was flagged, what was blocked and when, for the last 90 days.

On-demand scans

Scan any package or repository on demand when something looks off, with a monthly allowance included.

10 seats for your maintainers

12 months, renewable

No credit card

Email support

Who qualifies Built for real open source projects

You do not need thousands of stars. We look for projects that are open, maintained and used by other people.

A public repository on GitHub

An OSI approved license, such as MIT, Apache 2.0, GPL, BSD or MPL

Active maintenance, with at least one commit in the last 90 days

At least 3 months old, and not a fork or a mirror

You maintain it, which we confirm when you connect the SafeDep GitHub App

Run by its community, not the open core edition of a commercial product

What helps your application

Published to a package registry like npm, PyPI, Go, Maven or crates.io

Real usage, such as downloads or projects that depend on it

More than one active contributor

A healthy OpenSSF Scorecard

Part of a foundation such as CNCF, Apache, OpenJS or the Linux Foundation

Not sure your project fits? Apply anyway.

Sign in to SafeDep, connect the GitHub App to your project and tell us a little about it. It takes a few minutes.

We review every application and get back to you by email as soon as we can.

Approved projects get the Team plan with 10 seats for 12 months. We renew it as long as the project still qualifies.

Yes. There is no credit card and no trial that turns into a bill. Approved projects get the full Team plan at no cost.

Everything in the SafeDep Team plan, with 10 seats for your maintainers and core contributors. No features are held back.

The Team plan covers repositories, CI and developer machines. A quick review makes sure each grant goes to a real open source project and not to private company code.

Tell us in your application or reach out after you are approved. We look at larger projects case by case.

We check that the project still qualifies and renew the grant. If it no longer does, we let you know before anything changes.

The program is for your open source work. Using it on private company code goes against the program terms and can end the grant.

If the project is run by its community, yes. Open core projects where a company sells the paid edition are not covered, but we are happy to talk about other options.

No. If SafeDep helps your project, a "Secured by SafeDep" badge in your README or a mention is appreciated, but never required.

Apply in a few minutes. We will get back to you as soon as we can.