// HACKER NEWS — CYBERSECURITY
What I Learned Securing Sniffnet with the GitHub Secure Open Source Fund
I’ve always built Sniffnet with a security-first mindset, and today I’m thrilled to announce a major milestone
faithfully aligned with that philosophy: Sniffnet recently took part in the GitHub Secure Open Source Fund!
Backed by industry giants like Microsoft, Stripe, 1Password, and Shopify,
it’s a dedicated initiative focused on improving the security and sustainability of critical open-source software.
In this blog post, I’ll share how the program made Sniffnet more secure, and walk you through the steps you can follow to do the same.
After all, one of the most important lessons I’m taking away from this experience is that security is a joint effort of the whole
community: each project is a tiny piece of a bigger puzzle and no one can be completely safe if the rest of the ecosystem isn’t.
The program’s mission is to secure open source software that is widely used and critical to the modern stack.
It consists of an immersive 3-week sprint that provides each onboarded project with $10k in funding, hands-on training, and mentorship to help maintainers
understand that security is a baseline requirement, not a nice-to-have.
The sprint is curated by the GitHub Security Lab and delivered by a team of security experts.
Sniffnet and other 49 projects joined the fourth session of the program this past April,
and selected participants were asked not to share the news until today’s official announcement,
to avoid any potential exposure and to focus on securing our codebases.
The best part?
The program isn’t only about learning and theory: it’s designed as a series of practical steps
that have to be taken to satisfy outcome-driven goals and verified security requirements, having a tangible impact on the project and its users.
As mentioned in the introduction, I’ve always cared about securing Sniffnet:
this website’s homepage states that “one of the top priorities is to protect data privacy and system integrity”,
and not long ago the project underwent an independent security audit.
And… can you guess the specialization of my Computer Science Master’s degree?
Cybersecurity, of course!
Despite having been in the field for a while,
I had never been exposed to a structured security program like the Secure Open Source Fund,
and I was amazed by the number of tools that GitHub natively offers to make code more robust.
Unfortunately, the reality is that too often security is deferred to the end of the development cycle or,
even worse, only considered in a moment of panic after a vulnerability is discovered.
A shift in mentality is therefore needed to proactively design and plan security,
rather than downgrading it to a mere reactive countermeasure.