Alpha-Omega

🔑 Fewer keys under the doormat. Fewer opportunities for attackers. Open VSX now supports trusted publishing, replacing stored publishing tokens with credentials that last about five minutes and can publish just one extension. We’ve supported the Eclipse Foundation’s security program since 2022, helping make improvements like this possible. It’s a practical step toward reducing opportunities for credential theft across the developer ecosystem. Eclipse Foundation’s Mikael Barbero explains what’s changed, why release pipelines still need protection, and how extension publishers can make the switch. Read the blog: https://lnkd.in/grtu33-u PyPI Trail of Bits OpenSSF

The vLLM security audit is complete! 🔒 Supported by Alpha-Omega, the audit identified five security findings, including one critical and four high-severity issues, and delivered guidance to strengthen the project’s security over time. Thank you to Open Source Technology Improvement Fund, Inc (OSTIF), X41 D-Sec GmbH, and the vLLM maintainers and community for making this work happen. Special thanks to Russell Bryant and Juan Pérez de Algaba Sierra at Red Hat, and X41’s JJ, Markus Vervier, Niklas Abel, @Yassine El Baaj, and Antonela Conti. Using vLLM? Update to the latest release to benefit from the team’s work. Read the results: https://lnkd.in/gQZZ3qmQ

Woah! I guess we can say we captured the spirit of the conference: Thanks Alpha-Omega for awarding us the Best Paper Award

Bringing the open source community to the table. 🤝 Our Alpha-Omega roundtable at Open Source Summit Europe 2026 (#OSSummit) brought together contributors from The Apache Software Foundation, Rust Foundation, The PHP Foundation, Erlang Ecosystem Foundation, Maven Central, Open Source Technology Improvement Fund, Inc (OSTIF), The Perl Foundation, The PHP Foundation, AboutCode Foundation, OpenBao, The PHP Foundation, Scala, Ecosyste.ms, Sovereign Tech Agency, and more for candid conversations and shared ideas. From Security Engineers in Residence (SEiRs) to new opportunities for collaboration across ecosystems, the discussion offered fresh perspectives and concrete next steps. Thank you to everyone who joined us and helped shape what comes next! Read the blog by Mirko Swillus for the highlights: https://lnkd.in/g7EBdM49

LLMs are increasingly finding reachable, unwanted states. But per Jacob: "For better – and worse – the vast majority of reports are uninteresting, at least for Rust projects. Most can be summarized as “If you use the project in a way it wasn’t intended, then you have a bad user experience."" Jacob is a colleague at the Rust Foundation that has been on the ground stemming the huge tide of crates.io vulnerability reports (many of which he himself discovered). Jacob's observation is, providing certain kinds of information up front in the project will dramatically improve the quality of security findings. This matters because we need to prioritize high impact reports. Every report takes maintainer resources. We need to keep signal high so we don't bury the cases that deserve serious maintainer attention. Thank you to Alpha-Omega for supporting Jacob's work!

A reproducible bug isn’t always a security issue. For maintainers sorting through AI-generated reports, that distinction costs time. Jacob Finkelman, AI Security Engineer in Residence (SEiR) at the Rust Foundation, shares a practical way to reduce the noise: document what your project is intended to do. Start with three questions: 🔹 What is your project good for? 🔹 When should someone use it? 🔹 When should someone not use it? A few clear sentences can help improve reports and keep security conversations focused on what matters. Read more: https://lnkd.in/g6bmaDC2

Open Source Technology Improvement Fund, Inc (OSTIF) is proud to share the results of our security audit of vLLM. vLLM is an open source Python library for Language Learning Machines (LLMs), running interference for large LLMs quickly and efficiently. vLLM is now one of the most actively used open source AI projects with thousands of contributors. Thanks to X41 D-Sec GmbH and Alpha-Omega, this project underwent a source code audit to harden security and reinforce sustainability. Read about it here! https://lnkd.in/gjp9888v #OSTIF #vLLM #X41DSec 

📦 What’s behind nearly 15 billion package downloads? An open source ecosystem that businesses and developers rely on every day. In this clip, Michael Lubas (Paraxial.io) explores Hex’s economic impact and why securing the infrastructure behind Erlang, Elixir, and Gleam matters. Alpha-Omega helped fund that work through the Erlang Ecosystem Foundation’s Ægis initiative, supporting independent security audits that led to concrete fixes. Explore the case study: https://lnkd.in/g_dR-Tya