Non-profit org that connects open-source projects with security resources. We are the Open Source Technology Improvement Fund.
Chicago, IL
Joined May 2015
- Tweets986
- Following801
- Followers1.8K
- Likes1.9K
With the help of Shielder and LF-Energy, this project underwent custom security review with additional threat model assessment and tooling campaign.
Read about it here! ostif.org/power-grid-model-a…
In 2025, OSTIF advocated alongside the Scala project for funding of a security maintenance program. It took over a year of meetings and proposals to procure support, but the Scala team was ready and eager to work on holistically improving the security posture of the project.
Thanks to the support from the Sovereign Tech Agency, there is now a source code audit and supplemental supply-chain security review.
Read about it here! ostif.org/scala3-supply-chai…
#OSTIF #Scala3 #Scala
We're proud to share the results of our security audit of vLLM. vLLM is an open source Python library for Language Learning Machines (LLMs), running interference for large LLMs quickly and efficiently.
Read about it here! ostif.org/vllm-audit-complet…
#OSTIF #vLLM #X41DSec
Our Q3 026 Community Spotlight is Sarah Gran! Sarah works as the VP of Advancement for the Internet Security Research Group.
Read more about her work in open source in her own words.
ostif.org/q3-2026-community-…
#OSTIF #spotlight #ISRP
@OSTIFofficial is proud to share the results of our security audit of louis-rs. louis-rs is a Rust rewrite of Liblouis, a set of open source braille translator and backtranslator libraries written in C.
#louis-rs #liblouis #braille #ostif #sovereignTechAgency #shielder
Thanks to @ShielderSec and the @sovtechagency, this project received custom security review, documentation, and testing to harden and inform development as the project moves forward.
Read about it here! ostif.org/louis-rs-audit-com…
We published our 100th security audit earlier this year.
Read more here: ostif.org/100th-audit-public…
Here’s a catch-up of @OSTIFofficial 2026 so far and our plans to cap out the year.
ostif.org/2026-a-very-early-…
#OSTIF
Take a look at @OSTIFofficial 's role in the Security Engineer in Residence (SEiR) program.
#SEiR #V-LAT #OSTIF
@OSTIFofficial is proud to share the results of our security audit of Scala, executed by a team of three auditors from Quarkslab. We want to thank our very own Derek Zimmer of OSTIF for advocating for this audit for a long time!
#OSTIF #Quarkslab #SovereignTechAgency #Scala
A lack of input sanitization on host header paths in Starlette leads to bypassing auth with a single character across a huge swath of Python LLM infrastructure.
Update to Starlette 1.0.1 as soon as possible and read more about this vulnerability on badhost.org