Merge pull request #683 from typelevel/blog/github-soss-fund-2026

Blog about GitHub SOSS Fund

Author: armanbilge

src/blog/directory.conf

@@ -20,6 +20,14 @@ foundation {
   bio: "The Typelevel Foundation is a nonprofit 501(c)(3) public charity. Our mission is to maintain Typelevel projects, advance research and education in functional programming, and grow our community."
 }
 
+security {
+  name: Typelevel Security Team
+  avatar: "https://github.com/typelevel.png"
+  url: "/foundation/people.html#security-team"
+  email: "security@typelevel.org"
+  bio: "The Security Team receives and handles reports of security issues following the procedures described in the Typelevel Security Policy."
+}
+
 InTheNow {
   name: "Alistair Johnson"
   bio: "Alistair has been programming for far too long, for far too many companies, but is still passionate about promoting the integration of maths, science and engineering into everyday programming life."

src/blog/github-soss-fund-2026.md

@@ -0,0 +1,28 @@
+{%
+  author: [${armanbilge}, ${security}]
+  date: "2026-08-13"
+  tags: [security]
+%}
+
+# GitHub Secure Open Source Fund
+
+We are proud to announce that Typelevel is a graduate of [Session 4 of the GitHub Secure Open Source Fund][session4]. In addition to a $10,000 grant to the [Typelevel Foundation], the program provided three intense weeks of instruction and workshops covering secure development practices and vulnerability handling in open source. Antonio Jimenez and I participated together and, with support from the Typelevel Security Team, began applying what we learned to harden Typelevel's security posture. Some of the changes we made include:
+
+* Requiring members of our GitHub org to enable **secure two-factor authentication methods**. We also invited all maintainers of organization projects to become full members of the org (instead of external collaborators).
+* Creating an advanced security configuration that enabled **private vulnerability reporting** and applying it to all of our public repositories. We also updated our [Security Policy] with more detailed reporting instructions.
+* Prototyping some [enhancements to sbt-typelevel][pr882] that integrate **vulnerability detection** into the existing dependency submission workflows. We plan to roll these out in an upcoming release.
+
+Thank you to our maintainers for your cooperation and patience during these changes.
+
+Following his completion of the program, the Board appointed Antonio to the Security Team in May. He will present a talk about our experience ["Securing Typelevel: Lessons from the GitHub SOS Fund"][Securing Typelevel] at Scala Days this October in Berlin. For Antonio and me, the value of participating went beyond the instruction and access to security experts: it created an important opportunity for knowledge transfer as we reviewed prior security incidents in Typelevel and how they were handled.
+
+[Applications are open][application] for the next round of the [GitHub Secure Open Source Fund][soss] and we strongly encourage you to apply! If you are interested in participating, please [reach out] so that we can support your application.
+
+[session4]: https://github.blog/open-source/maintainers/what-50-open-source-projects-taught-us-about-security-in-the-ai-era/#h-core-programming-languages-runtimes-and-foundational-libraries
+[Typelevel Foundation]: /foundation/README.md
+[Security Policy]: /security.md
+[pr882]: https://github.com/typelevel/sbt-typelevel/pull/882
+[Securing Typelevel]: https://scaladays.org/session/securing-typelevel-lessons-from-the-github-sos-fund/
+[application]: https://forms.office.com/r/YN3MWEKQ5m
+[soss]: https://github.com/open-source/github-secure-open-source-fund/
+[reach out]: mailto:security@typelevel.org

src/directory.conf

@@ -212,6 +212,8 @@ zainabali {
 
 # sponsors
 
+sponsors: [${spotify}, ${aruna}, ${shopify}, ${input-objects}, ${famly}, ${github}]
+
 spotify {
   logo: /img/sponsors/spotify.svg
   url: "https://engineering.atspotify.com/2024/11/congratulations-to-the-recipients-of-the-2024-spotify-foss-fund"
@@ -236,3 +238,8 @@ famly {
   logo: /img/sponsors/famly.svg
   url: "https://famly.co"
 }
+
+github {
+  logo: /img/sponsors/gh-soss-fund.png
+  url: "https://github.com/open-source/github-secure-open-source-fund"
+}

src/foundation/README.md

@@ -1,7 +1,6 @@
 {%
   laika.html.template: about.template.html
   laika.title: Typelevel Foundation
-  sponsors: [${spotify}, ${aruna}, ${shopify}, ${input-objects}, ${famly}]
 %}
 
 # About the Typelevel Foundation

src/img/sponsors/gh-soss-fund.png

@@ -1,7 +1,3 @@
-{%
-sponsors: [${spotify}, ${aruna}, ${shopify}, ${input-objects}, ${famly}]
-%}
-
 @:embed(/templates/main.template.html)
 <div class="bulma-section">
   <div class="bulma-container bulma-is-max-desktop">