<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=705633339897683&amp;ev=PageView&amp;noscript=1">
[go: up one dir, main page]
For application development
Reduce security risk from bad open source packages
Reduce security risk from bad open source packages
Contact us   See it in action  
Learn how one large organization saved over $1.6M in manual package evaluation time and eliminated over 3,000 points of risk in applications running in production.
Read the story
Read the case stories
The Tidelift maintainer advantage
Tidelift is the only company that partners with open source maintainers and pays them to: 
Implement industry-leading secure software development practices and validate the practices they follow so organizations can have the same confidence in the security of their open source that they have in their own code.
Contractually commit to continue these practices into the future so that organizations can confidently make long term investments in the packages they use.
Learn more
jackson-databind

jackson-databind

Maintainer Tatu Saloranta used income from Tidelift and its customers to completely rearchitect jackson-databind and eliminate the risk of RCE vulnerabilities.
Read the story
minimist

minimist

Maintainer Jordan Harband saved minimist from deletion when its maintainer decided to delete their projects from GitHub.
Read the story
urllib3

urllib3

Maintainer Seth Michael Larson was able to substantially improve urllib3 security practices thanks to income from Tidelift and its customers.
Read the story
sockjs

SockJS

When SockJS maintainer Bryce Kahle took a new job that didn’t involve JavaScript, Asif Saif Uddin stepped in as maintainer, ensuring the project wasn’t abandoned.
Read the story
Pillow: a Tidelift maintainer case story

Pillow

Maintainer Jeffrey A. Clark  significantly improved security practices used to maintain Pillow, a popular Python Image Library package downloaded 3 million times a day.
Read the story
jordan-harband-javascript-logo

Jordan Harband

Maintainer Jordan Harband used income from Tidelift and its customers to consistently maintain over 450 JavaScript packages during good times and bad.
Read the story
mongoose

Mongoose

Maintainer Valeri Karpov of Mongoose implemented additional secure development practices and significantly improved the project’s OpenSSF scorecards score.
Read the story
Apache Commons

Apache Commons

Maintainer Gary Gregory of Apache Commons used income from Tidelift and its customers to carve out  time to create a more robust security review process.
Read the story
Bad open source packages slow you down.
Healthy and resilient packages speed you up.

Vulnerable open source packages create risk that could potentially impact
your organization’s revenue, data, and business continuity. 

Tidelift_HomepageAssets_a01v01_BadPackages

Stop getting slowed down by bad packages that have been end-of-lifed, abandoned, or are insecure. 

Tidelift_HomepageAssets_a01v01_Proactive

Start making better, proactive decisions about which packages to use—and which to avoid—so you can take advantage of the full innovative potential of open source. 

Tidelift helps leading organizations
use open source with confidence
Reduce s.r.
Reduce security risk

by eliminating attack entry points through bad packages

Improve p.
Improve productivity

by reducing vulnerability fire drills from insecure or undermaintained packages 

Improve a.q.
Improve application quality 

by building with healthy and resilient open source packages

Increase o.e.
Increase operational efficiency 

by saving costly manual package evaluation time

Learn more about the Tidelift Subscription   See how customers use Tidelift
Resources to get you started
the-2024-tidelit-maintainer-impact-report-1200x630
The 2024 Tidelift maintainer impact report

Our annual maintainer impact report shines a light on the most current and compelling evidence of the positive outcomes organizations can achieve when they invest directly in their open source software supply chain by paying maintainers.

Tidelift_WebinarGraphics_social-Oct-07-2024-07-11-55-6309-PM
Open source security through the lens of Tidelift

Cisco’s internal development teams, using Corona enhanced with open source metadata provided by Tidelift, can now access insightful package metadata and gain additional insights into vulnerabilities. 

Read now

2024-survey-report-1200x628
The 2024 Tidelift state of the open source maintainer report

The results of the 2024 Tidelift state of the open source maintainer report are live! In this year's survey, we identified 12 big headlines out of the data we collected from 400 open source maintainers.

Read now

See all resources