Besides individual sponsors, some public bodies and industry funded programmes pay for open source maintenance and security work. One example, the Sovereign Tech Fund, invests in open digital base technologies such as libraries, package managers and protocols, and asks that code be free software. Check each programme's own criteria for eligibility.
What one public fund says
The Sovereign Tech Fund page describes the open source ecosystem as successful but increasingly fragile, because many more people use the software than contribute to it. It invests in open digital base technologies that are vital to developing other software or that enable digital networking. Examples listed include libraries for programming languages, package managers, open implementations of communication protocols, administration tools for developers and digital encryption technologies. It does not finance prototypes, and says it is not currently looking for user facing applications.
Requirements and criteria
The page sets requirements for applicants, summarised here.
| Item | What it asks |
|---|---|
| Application route | Through its online platform, completed in German or English |
| Activities | Development or maintenance of open digital base technologies; audits and events can be included if necessary |
| Public financing | Not eligible if other public entities already fund the same activities |
| Licence | Code and documentation freely reusable, changeable and redistributable |
It also lists review criteria: prevalence (widely used within other technologies), relevance to important sectors, vulnerability (important work is not sufficiently funded by other actors), and public interest.
I am not repeating the minimum cost threshold or any amounts here, since those can change. Read the page itself.
Why this matters to a dependent
The criteria are a useful lens for your own risk review. A project that is widely used, relevant and underfunded is exactly the kind that creates risk for its users. Public funds may help some of them, but they cannot cover every project, and eligibility rules rule many out.
Other programmes exist too, for example the Alpha-Omega project, whose site says it works with maintainers, researchers and the wider community to enable practical and sustainable security work for open source. I did not verify its funding rules for this article.
Steps for a company
- Rank your open source dependencies by how widely your products rely on them.
- Mark the ones that are hard to replace and thinly maintained.
- Check whether each has a funding page, a foundation home or public programme support.
- Decide a budget route for support, and who decides.
- Offer practical help too: testing, documentation, reproducing bugs and reviewing patches.
- Revisit the list yearly.
For maintainers
If you maintain a base technology, read the criteria of public programmes and write down your project's prevalence and funding gaps. Having the answer ready makes any application easier.
Quick check
Can a project get public funding and sponsor money?
Often yes, but this fund excludes work already funded by other public entities.
Does funding guarantee security fixes?
No. It supports the work. Fixes still depend on maintainers and process.
Where are the up to date rules?
On each programme's own page. Do not rely on summaries.
How Safeguard helps
Safeguard's SBOM and dependency scanning show which upstream versions you depend on, and reachability analysis helps you decide which advisories matter for your code. Compliance and evidence automation can record how you handled each one. Autonomous remediation can open fix pull requests; it is off by default and every category starts on Manual. You can run the free scan on a manifest to see where you stand.
Sources
- Sovereign Tech Agency, Sovereign Tech Fund application page: requirements and criteria. Fetched 19 October 2026.
- Alpha-Omega, alpha-omega.dev: programme description. Fetched 19 October 2026.
Last reviewed: 19 October 2026.
