The rules
- Money unlocks nothingEvery feature is free for everyone. Donating or sponsoring gives no access to rules, formats or integrations that others do not have.
- The accounts are publicEvery month we publish how much came in and what it was spent on. The detail is on this page and the history is in the repository.
- Companies can sponsorThey can be listed as sponsors if they wish, but they get no priority on issues, no custom changes and no vote on the detection rules.
- If there is money left, it goes back into the projectFirst into maintenance, then into independent security audits of the code and the release pipeline. Spending decisions are discussed in the open.
The accounts
What it is spent on
- Domain and hosting for this site and for the malicious-package database feed.
- Independent security audits of the code, the signatures and the release process.
- Tooling needed to publish in a reproducible, verifiable way (signatures, release attestations).
- Maintenance hours, only when there are enough funds and after discussing it in the open.
If you want to help
It is optional. A star, a false-positive report or a new rule help as much as money.