Open Source Visual Mock-up Skip to main content
Design mock-up · Option C: short and visual This is a shorter, more visual version of the proposed Open Source page, prepared for Trail of Bits review.

Our investment in open source

Since 2012 we have invested engineering time in the open-source software the industry depends on. We fix bugs upstream, build security infrastructure for package ecosystems, publish our audits and release our tools.

See 2025 in one chart Browse on GitHub
1,575+
Upstream PRs merged, 2023 to 2025
90+
Projects contributed to in 2025
660
Public audit reports
102k
GitHub stars across our repositories
  • Sigstore
  • PyPI
  • Python
  • Homebrew
  • RubyGems
  • vLLM
  • PyTorch
  • Hugging Face
  • ONNX
  • RustCrypto
  • OpenSSL
  • Open Quantum Safe
  • Botan
  • cURL
  • Let's Encrypt
  • LLVM
  • Rust
  • Go
  • Ethereum
  • Solady
  • Zcash
  • Kubernetes
  • Linux
  • NixOS
  • aiohttp
  • urllib3
  • SQLite
  • Samba
  • BIND 9
  • Zeek
  • Suricata
  • Scapy
  • NATS
  • Valkey
  • Keycloak
  • Drupal
  • WordPress
  • PHP
  • Ruby on Rails
  • Symfony
  • Matrix
  • Ladybird
  • SciPy
  • OpenClaw
  • Harbor
  • gem.coop
  • Ansible
  • rsync
  • zlib
  • cryptlib
  • Noble cryptography
  • mlkem-native
  • SecureDrop
  • Jaeger
  • OpenBao
  • GPAC

Our open-source work in each security domain

Every PR we merged upstream in 2025

Each square is one PR we merged into a project outside Trail of Bits, stacked in a column for each month and colored by category. Click a category to show only its PRs, click a month to see it day by day, or click a square to see the PR and the rest of that project's PRs.

Read the 2025 recap
385
Merged PRs
91
Projects
16
Engineers

2025 by month

Securing Python packaging, 2023 to 2026

These seven milestones come from our work with the Python Packaging Authority, PyPI and Sigstore. Drag the slider, use the arrows or click a card to move through them, and open any milestone to read the post or proposal behind it.

  1. May 23, 2023
    Infrastructure

    Trusted Publishing: a new benchmark for packaging security

    OIDC-based publishing for PyPI replaces long-lived API tokens with short-lived tokens scoped to a CI identity. Google's Open Source Security Team funded this work.

    Adoption

    By November 2024, 19,578 PyPI projects had registered a Trusted Publisher, and about 447,000 files had been published through it.

    Read the post
  2. Nov 14, 2024
    Standard

    Attestations: a new generation of signatures on PyPI

    We implemented PEP 740 index-hosted attestations using Sigstore, and they are enabled by default in the official PyPI publish action.

    Reach

    About 20,000 packages could publish attestations by default when the feature launched.

    Read the post
  3. Jan 30, 2025
    Upstream PR

    PyPI now supports archiving projects

    Maintainers can now mark a project as archived to show downstream users that it no longer receives updates. Alpha-Omega funded this work.

    Funding

    Alpha-Omega funded this work as part of our long-running collaboration with PyPI.

    Read the post
  4. Sep 24, 2025
    Research

    Supply chain attacks are exploiting our assumptions

    This post explains the trust assumptions behind package installs and how build provenance and signing address them.

    Covers

    The post connects Trusted Publishing, PEP 740 attestations and Homebrew build provenance, and introduces our It-Depends and Deptective tools.

    Read the post
  5. Dec 12, 2025
    Tool

    Catching malicious package releases using a transparency log

    We made rekor-monitor ready for production use, so PyPI and npm maintainers are alerted when their signing identity is misused. OpenSSF funded this work.

    Scale

    We merged 39 PRs into rekor-monitor during 2025, with funding from OpenSSF.

    Read the post
  6. Jan 29, 2026
    Infrastructure

    Building cryptographic agility into Sigstore

    We replaced hard-coded algorithms with configurable algorithm suites across Fulcio, Rekor, Cosign and sigstore-go, which prepares Sigstore for post-quantum signing.

    Funding

    Google, OpenSSF and Hewlett-Packard funded parts of this two-year effort, which also produced our lms-go and ml-dsa Go libraries.

    Read the post
  7. 2026
    Standard

    A transparency log for PyPI

    We have written a draft PEP and run a test log that records every PyPI artifact and its publishing identity in a tamper-evident log.

    Estimate

    The proposal estimates about 4 GB of log data and about 40 GB of proofs to cover 22 million PyPI entries.

    Read the proposal
May 23, 2023 · 1 of 7

Our most widely used tools

We publicly release nearly all of our internal tooling. The full catalog on the Open Source tools page groups each tool by the problem it solves.

View the full catalog
Solidity / Vyper 6.4k

Slither

Slither runs static analysis on Solidity and Vyper code, with built-in detectors and an API for custom checks.

View tool
Ethereum contracts 3.2k

Echidna

Echidna is a property-based fuzzer that generates grammar-based inputs to test the invariants of Ethereum contracts.

View tool
AI / CRS 1.7k

Buttercup

Buttercup is our AIxCC cyber reasoning system, which finds and patches vulnerabilities in open-source code.

View tool
Claude Code plugins 7.8k

Skills

Our security research and audit workflows are published as skills for AI coding agents.

View tool

Ways to work with us

Our GitHub organizations

You can fork our repositories, file issues and send pull requests. Most of what we build is public.

Patch the Planet

Do you maintain a critical open-source project?

Patch the Planet gives selected maintainers a week of dedicated security engineering, including patches.

Apply now Dashboard