71 maintainers from 50 different open source projects and across 22 countries were selected to participate in the program. It was amazing to meet so many maintainers from other open source projects and chat about the issues the we all face and how we deal with them. It feels like we’ve built a small community that can lean on each other for help and advice in the future.

[1] Joining a video call from Bute Park, Cardiff.

The program was spread over 3 weeks and consisted of a mixture of talks and workshop sessions by experts from the GitHub Security Lab and other security professionals. These sessions covered a range of topics, from pipeline security and dependency management to private vulnerability reporting and AI prompt injection.

We were given some homework in the form of documenting our project-specific security policies and best practises. You can find the result of this work in our Incident Response Plan and Threat Model files in the GitHub repository and under the “Security” section of our website. We also had to reconfigure our repository settings and enable some security features that we had not previously enabled.

To my delight, the weather in Cardiff over the course of the program was unusually pleasant for the time of year and I was able to sit with my laptop and some headphones in Bute Park to attend some of the calls [1].

There are a few main things I will take away from this program. Firstly, the community. Getting to know other maintainers and being able to reach out to them or members of the GitHub Security Lab will be invaluable going forwards. It’s impossible to know everything and having a group that can help one another in times of need is a privilege.

In terms of knowledge, creating the Incident Report Plan and Thread Model made me take a closer look at our methodology for dealing with security incidents. Having a formalised process will give us the confidence to fix things in the right way going forwards. We’ve already received and fixed several privately reported bugs since the program completed.

I also learnt a lot about how GitHub Security Advisories (GHSAs) and Common Vulnerabilities and Exposures (CVEs) are generated and dealt with. I learnt what a Software Bill of Materials (SBOM) is and why it’s useful and how to implement and use Code QL and code/secret scanning properly.

I had a lot of fun and learnt a lot! Most importantly, I got to sit in the sun and touch some grass for a bit. I strongly encourage anyone who is an open source maintainer who hasn’t already taken part in the program to keep an eye out for future sessions. It really is worth the time to participate.