GitHub has published results from Session 4 of its Secure Open Source Fund, a program that pairs maintainers with funding, GitHub Security Lab experts, security tooling, AI-assisted workflows, and a peer community.

The latest cohort covered 50 open source projects. GitHub says the program invested more than $500,000 across those projects, with funding going directly to maintainers in staged payments. The fund page lists a $6,000 payment during the program, followed by $2,000 check-ins at six and 12 months.

The security work was concrete rather than only educational. GitHub says 92% of projects completed the program with core security features enabled, including secret scanning, code scanning, protected branches, private vulnerability reporting, and Dependabot. Across participating and alumni projects, GitHub reports 533 newly identified and disclosed CVEs, more than 1,500 Dependabot security updates, and more than 650 exposed secrets resolved. In the six months ending July 2026, the same project set fixed 4,210 CodeQL alerts and blocked 119 secrets before exposure.

The AI angle is more cautious than promotional. GitHub's write-up says maintainers used tools such as Copilot to help with vulnerability triage, threat modeling, code review, and remediation, but framed human maintainers as the final decision-makers for context, judgment, and accountability.

That distinction matters for open source infrastructure. AI can speed up security investigation and cleanup, but the program's results point to process, defaults, and maintainer time as the durable parts of the work.