SecNews

TAG

#open-source

8月27日周四

  1. GitHub Security Blog

    OpenClaw went viral. Meet the maintainers building and securing it.

    maintainersopen-sourceopenclaw

    What began as a personal experiment quickly became a global open source project with extraordinary momentum. OpenClaw is a personal AI assistant that runs on users’ devices and connects with the messaging channels they already use. Started by Peter Steinberger as a weekend project in November 2025, its GitHub repository has grown to approximately 388,000 stars, 81,000 forks, and more than 80,000 commits by August 26, 2026. In this video interview, filmed just six months into the project, creator Peter Steinberger and several OpenClaw maintainers discuss managing a surge of pull requests, rethinking contributor trust and code review, addressing software supply chain risks, and balancing powerful agent capabilities with security. They also share security lessons from the GitHub Secure Open Source Fund and the value of connecting with maintainers facing similar challenges. Watch the full video above, then explore the key lessons below. People in this video The following maintainers shared their experiences maintaining and securing OpenClaw. Peter Steinberger, Creator of OpenClaw Brad Groux, CEO, Digital Meld Josh Avant, Member of technical staff, OpenClaw Foundation Josh Lehman, Martian Engineering Sally O’Malley, Principal software engineer at Red Hat Val Alexander, OpenCoven Vincent Koc, Chief architect, OpenClaw Foundation Here are the top 10 lessons that we took away from the conversation. Lessons 1–3: How AI changed contributions and community 1. Pull requ

8月13日周四

  1. GitHub Security Blog

    What 50 open source projects taught us about security in the AI era

    ai-securitymaintainersopen-sourcesupply-chain-security

    AI is changing the pace of open source development and the security challenges that come with it. Maintainers are reviewing unfamiliar contributions, managing new attack surfaces, and responding to vulnerabilities with limited time and resources. Session 4 of the GitHub Secure Open Source Fund tested a practical response. The Secure Fund invested more than $500,000 across 50 projects, pairing maintainers with GitHub Security Lab experts, GitHub security tools, AI-assisted workflows, and a peer community. One lesson emerged consistently: AI can help maintainers investigate, prioritize, and respond faster. Maintainers still provide the context, judgement, and accountability required to decide what ships. OpenClaw was invited to participate in Session 4 because it is GitHub’s fastest-growing open source project, and its maintainers wanted to strengthen its security posture. By the end of Session 4, OpenClaw developed an incident response plan, expanded its use of GitHub security tooling, audited its GitHub Actions workflows, and strengthened its processes for identifying and responding to security issues. The maintainers shared: OpenClaw’s experience reflects the broader story of Session 4. While the specific risks varied across the cohort, maintainers shared a consistent need: the knowledge, tools, and expert support to secure software as AI changed how they built it. Across the program, maintainers turned that support into concrete security improvements. Projects s