The Open Source Pledge is a group of companies committed to paying the maintainers of the open source software they depend on. Its stated norm is a minimum of 2,000 US dollars per year per full-time equivalent developer, paid in cash directly to maintainers or foundations. It does not handle the money itself.
What it says
The Pledge's own page frames the problem as maintainers who are often unpaid and burned out, which makes the ecosystem fragile and exposes everyone to supply chain security issues. Its answer is a social norm: companies pay. The members choose which maintainers or foundations to pay. The Pledge states that it never handles funds and that payments go directly to recipients. Companies publish an annual report of what they paid.
What counts
| Counts | Does not count |
|---|---|
| Cash with no strings attached to open source maintainers | Projects your company controls or owns the trademark for |
| Payments to open source foundations | Projects that exclusively benefit your company's own ecosystem |
| Payments through any platform, if the payment meets the criteria | Directly employing maintainers (praised, but outside core scope) |
| Projects that meet the Open Source Definition | Payments that give the company more than minimal benefit |
The Pledge allows minimal benefits, such as non-exclusive logo placement or an hour or two of consulting along with a large sponsorship. Anything beyond that moves a payment out of scope. It also says that hiring developers or giving cloud credits, while valuable, do not count toward membership because the mission focuses on cash.
Individuals cannot join. Single-person companies can.
How to use the idea without joining
You can adopt the logic whether or not you join:
- Pick a budget that scales with headcount, so it grows with the company.
- Choose recipients from your dependency inventory. See which dependencies to fund.
- Pay without conditions, apart from normal tax and invoicing paperwork.
- Report what you paid, internally at least, once a year.
- Separate it from your support contracts. A support contract buys a service. A donation buys goodwill and continuity.
Limits and honest caveats
- A fixed per-developer figure is a norm, not a rule of law. A small startup may pay less, a large one more.
- Payment does not buy a security fix. Fund maintainers for health, and do your own patching.
- Not every critical project can accept money easily. The Pledge notes that most foundations are not yet set up to pay maintainers directly.
- Counting only cash leaves out valuable work like upstream code and audits. Do both.
A one paragraph internal policy
"We pay open source maintainers and foundations in cash each year, with an amount set by headcount. The open source owner chooses recipients from our inventory, and finance pays them. We publish the total in our annual internal report."
Where Safeguard fits
The hardest part for most companies is knowing what they depend on. Safeguard's SBOM and dependency scanning produces that inventory. A free scan is available at gold.safeguard.sh/scan.
Quick check
Does the Pledge collect the money?
No. It states it never handles funds. Members pay maintainers directly.
Do we have to join to fund maintainers?
No. You can pay maintainers through any platform without joining. The Pledge is one way to make the commitment public.
Sources
Last reviewed: 19 October 2026.
