Maintainers are now a prime target for malicious packages and hijacked dependencies. We give qualifying open source projects the full SafeDep Team plan for free, with 10 seats for your maintainers.
Open source is what everyone builds on. The people who maintain it deserve the same protection that large companies pay for.
Attackers publish lookalike packages, take over maintainer accounts and slip malicious code into dependencies. When one popular project is hit, everyone downstream is hit too. Most maintainers protect millions of users in their spare time.
No cut down edition and no feature gates. Approved projects get the same plan that paying teams use.
Every dependency is checked against SafeDep threat intelligence. Known bad packages are caught before they land in your project.
The SafeDep GitHub App reviews new and changed dependencies on every pull request, so you never have to read a lockfile diff by hand.
PMG blocks malicious installs on the laptops and CI runners your maintainers use, and syncs every event to your SafeDep tenant.
See findings across every repository in your project and set the rules once for all of them.
Look back at what was flagged, what was blocked and when, for the last 90 days.
Scan any package or repository on demand when something looks off, with a monthly allowance included.
You do not need thousands of stars. We look for projects that are open, maintained and used by other people.
Not sure your project fits? Apply anyway.
Sign in to SafeDep, connect the GitHub App to your project and tell us a little about it. It takes a few minutes.
We review every application and get back to you by email as soon as we can.
Approved projects get the Team plan with 10 seats for 12 months. We renew it as long as the project still qualifies.
Yes. There is no credit card and no trial that turns into a bill. Approved projects get the full Team plan at no cost.
Everything in the SafeDep Team plan, with 10 seats for your maintainers and core contributors. No features are held back.
The Team plan covers repositories, CI and developer machines. A quick review makes sure each grant goes to a real open source project and not to private company code.
Tell us in your application or reach out after you are approved. We look at larger projects case by case.
We check that the project still qualifies and renew the grant. If it no longer does, we let you know before anything changes.
The program is for your open source work. Using it on private company code goes against the program terms and can end the grant.
If the project is run by its community, yes. Open core projects where a company sells the paid edition are not covered, but we are happy to talk about other options.
No. If SafeDep helps your project, a "Secured by SafeDep" badge in your README or a mention is appreciated, but never required.
Apply in a few minutes. We will get back to you as soon as we can.
