GitHub the system to provide financial support for open projects. The new service offers a new way to engage in project development — if a user cannot help with development, they can connect with interesting projects as a sponsor and assist by funding specific developers, maintainers, designers, documentation authors, testers, and other participants involved in the project.
With the sponsorship system, any GitHub user can contribute fixed monthly amounts to open-source developers, in the service as participants willing to receive financial support (during the testing phase, the number of participants is limited). Sponsored participants can determine support levels and associated privileges for sponsors, such as priority bug fixes. There is consideration for organizing funding not only for individual participants but also for groups of developers involved in the project.
Unlike other crowdfunding platforms, GitHub does not take a percentage for mediation and will cover payment processing fees for the first year. In the future, the possibility of introducing a fee for payment processing is not ruled out. A special fund, the GitHub Sponsors Matching Fund, has been created to manage financial flows.
In addition to sponsorship, GitHub also a new service for ensuring project security based on technologies obtained from the company Dependabot. Dependabot is now integrated into GitHub and available for free.
The service allows tracking vulnerabilities in dependencies, sending alerts to repository owners about issues with dependencies, and automatically opening pull requests to fix identified vulnerabilities.
Alerts are displayed in the 'Security' tab and include comprehensive details about the vulnerability and the project files affected. Fixes are generated through updates in the dependency list, changing the minimum version to one in which the vulnerability is resolved. Vulnerability information is extracted from databases and , as well as based on notifications from project maintainers and the automatic commit analyzer on GitHub, followed by confirmation in the manual review system.
For project maintainers an interface for publishing and hosting security advisories, as well as for private discussions within a closed group regarding vulnerability fixes.
In addition, to protect against sensitive data into publicly accessible repositories, a for tokens and access keys has been implemented. During commits, the scanner checks for common formats of keys and tokens for API access to Alibaba Cloud, Amazon Web Services (AWS), Azure, GitHub, Google Cloud, Mailgun, Slack, Stripe, and Twilio. If a token is detected, a request is sent to the service provider to confirm the leak and revoke the compromised tokens.
Source: opennet.ru
