25 October 2026. Safeguard.sh Inc today published a paper, "Fixing Open Source at the Source: The Case for Continuously Verified Components Before January 2027", by its founder Hritik Kumar Sharma. The paper looks at why vulnerabilities in open source components take so long to be fixed in the software that depends on them, and sets out a model for publishing components that are continuously verified.
The full paper is available as a PDF attached to this release, and as full text on the Safeguard blog. It has also been submitted to SSRN.
What the paper covers
- Two gaps in open source remediation. The paper separates the upgrade gap (the time between a fixed release being published and that release running in production) from the fix gap (the time before any fix exists). It draws on published studies of the npm and Maven ecosystems, and on incidents such as Log4Shell and the xz Utils backdoor.
- The regulatory clock. Under the EU Cyber Resilience Act, manufacturers have had to report actively exploited vulnerabilities since 11 September 2026, with an early warning due within 24 hours. Most of the Act's other obligations apply from 11 December 2027.
- A verification bar for components. A component is "Gold" only while it carries no exploitable critical or high severity vulnerabilities, has a completed license review, has signed build provenance (with SLSA Build Level 3 as the design target), and has a public evidence record. It loses that status if it regresses.
- A lifecycle that patches upstream first. The model fixes vulnerabilities upstream where possible, and uses maintained forks only when upstream cannot or will not move.
- Limits, stated plainly. The paper covers what the model does not solve, including vendor software, the trust placed in a rebuilder, and the cost of maintaining forks.
The paper proposes an objective: to help organisations remediate the open source they depend on before January 2027, ahead of the Act's main obligations, and it lists indicators for measuring progress.
Availability
Safeguard's Gold Open Source directory at gold.safeguard.sh is free and needs no login. Gold Registry, for hardened packages and container images, is generally available. The fork and patch flow described in the paper is generally available.
About Safeguard
Safeguard.sh Inc builds software supply chain security tools, including SBOM generation and analysis, vulnerability management, autonomous remediation and Gold components. Learn more at safeguard.sh.
Media contact: press@safeguard.sh
Download: Fixing Open Source at the Source (PDF, 6 pages)
Fix it without waiting for upstream
Read the one page summary or start with a free lookup on gold.safeguard.sh.
