SEIRs
An Alpha-Omega initiative
Security Engineers in Residence
Hands-on security engineers embedded in the open source ecosystems the world depends on. They help maintainers find, validate and fix the vulnerabilities that matter, and build the capacity to keep doing so in the age of highly capable AI.
Open source security is under growing pressure. AI makes vulnerability discovery faster and cheaper, floods maintainers with reports of wildly varying quality, and lowers the bar for attacks on software, infrastructure and the people who maintain it. Most ecosystems have no dedicated capacity to absorb this.
Rising volumes of AI-generated vulnerability reports, both low-quality noise and credible findings, all of which need a human to triage.
AI-assisted scanning finds real bugs at scale. Someone has to validate them, explain them, and help get them fixed.
Automated tooling lets a small number of people probe many projects at once. Defenders need coordinated capacity to keep pace.
Maintainers need trusted, practical support, not another queue to manage. SEIRs work with them as partners.
A SEIR is contracted by an ecosystem organisation and supported by an Alpha-Omega grant. The role combines practical security engineering, trusted maintainer support, rapid response and cross-ecosystem coordination. It is not an audit or enforcement function. It is capacity.
Proactive review of ecosystem projects using human-led and AI-assisted methods. Findings are validated before escalation so maintainers only see issues that matter in practice.
Explain findings clearly, assess severity in context, help develop fixes, and support responsible disclosure and release coordination.
Act as a trusted technical resource when urgent issues arise: assess exploitability, coordinate short-term mitigation, and manage surges of incoming reports.
Engage constructively and respectfully, with usable guidance and collaborative problem-solving that improves security practice over the long term.
Document workflows for triage, outreach, disclosure and response. Build tools, prompts and threat models so the work scales beyond one person.
SEIRs form a virtual team. They meet regularly, share lessons learned and build a common body of practice for securing open source against AI-enabled threats.
SEIRs are deployed where the leverage is greatest: the critical ecosystems, and within them the critical projects.
The programme started in May 2026 with six-month engagements and has been renewed for a further six months. The SEIR and ecosystem counts are actual. The four activity figures are projections for a full six-month funding period, extrapolated from what SEIRs reported in two-week survey rounds, not audited totals.
SEIRs and their host foundations write about the work as it happens. These posts cover launches, early results and lessons learned across the programme.
Drupal
Drupal published 256 security advisories between June and October 2026, more than in the previous 30 months combined. The funded team helped the volunteer Security Team absorb the surge in AI-assisted discovery.
By Tiffany Farriss, Drupal Association
Rust
One sentence on what a project is for, and what it is not for, helps AI scanners and maintainers judge whether a report matters. A rough answer beats none, and a formal threat model can follow later.
By Jacob Finkelman, Rust Foundation
Node.js
A maintainer's guide to GitHub Security Advisories. The fix is rarely the hard part: deciding whether a report is valid and in scope, and knowing the platform quirks that follow, is.
By Ulises Gascón, OpenJS Foundation
Erlang / Elixir
The Erlang Ecosystem Foundation scans Erlang and Elixir packages, core infrastructure and the top Hex dependencies. Monthly CVE volume grew from one in January to 80 in August, and the work needs sustained funding.
By Dan Janowski, Erlang Ecosystem Foundation
OSTIF
OSTIF's view of the programme and its own contribution, Project V-LAT: a team of six researchers triaging vulnerabilities, working through a backlog of roughly 450 reported issues and helping maintainers with fixes.
By Helen Woeste, OSTIF
Drupal
Funded engineering capacity added to Drupal's volunteer Security Team. In six weeks: more than 10 advisories and CVEs, over 30 issues filed, and 10 security issues resolved.
By Tiffany Farriss, Drupal Association
Perl / CPAN
The CPAN Security Group and The Perl and Raku Foundation launch a task force to strengthen the CPAN CNA, improve the security of CPAN and Perl, and prepare the community for analysis by advanced language models.
By CPAN Security Group and The Perl and Raku Foundation
Rust
Building a database of crates to prioritise, scanning the top 200+ crates with Scrutineer, and fixing the valid findings with crate owners, while talking to the community about how to handle AI-generated reports.
By Jacob Finkelman, Rust Foundation
FreeBSD
A six-month project to reduce exploitable vulnerabilities in FreeBSD, starting with the kernel, then the base system and ports. AI assists discovery; every patch is written by hand.
By FreeBSD Foundation
Node.js
The OpenJS Foundation, with NodeSource and Alpha-Omega, funds a SEIR for Node.js: handling AI-generated report volume, AI-assisted patch review, supply-chain incident response and an open-sourced triage skill library.
By Kylie Wagar-Dirks, OpenJS Foundation
Ruby
Ruby Central's SEIRs scan widely used gems, confirm real vulnerabilities and report them responsibly, sending maintainers only well-verified reports instead of adding to the flood of low-quality ones.
By Ruby Central
PHP
The PHP Foundation creates an Ecosystem Security Team to triage reports, disclose responsibly and build discovery and remediation tooling, led by a full-time SEIR for six months.
By Elizabeth Barron, The PHP Foundation
Open source ecosystems and foundations identify, engage and support their own SEIR with grant funding from Alpha-Omega. Read the role description to understand the scope, deliverables and how the engagement works.
Role descriptionSEIRs bring strong security engineering judgment, experience validating findings, fluency with AI-assisted workflows, and the ability to work constructively with maintainers. Engagements are typically six months.
Contact the programme