Sovereign Tech Resilience

Sovereign Tech Resilience takes a preventative approach to vulnerabilities in critical open digital infrastructure. The application on this page is for FOSS projects seeking participation in a program that combines direct technical contributions, bug and fix bounties, and security code audits; individual vulnerability research takes place through the linked YesWeHack bounty programs.

Key Details

The program was previously called the Bug Resilience Program.

Reward

Security researchers receive financial bounties for discovering and reporting vulnerabilities through participating bug bounty programs.
For every responsibly reported and fixed vulnerability, the Sovereign Tech Agency offers a “fix” bounty to the participating project.

Scope

Direct Contributions

Neighbourhoodie Software contributes directly to participating projects to address known issues, improve documentation, and reduce technical debt. This work is intended to make software easier to maintain, reduce opportunities for vulnerabilities, and improve the quality of external contributions.

Bug and Fix Bounty Programs

YesWeHack provides selected FOSS projects with access to security researchers and supports the triage and verification of submitted vulnerability reports. Participating bounty programs include:

Code Audits

Through the Open Source Technology Improvement Fund, the Sovereign Tech Agency provides security reviews for widely used software components. The reviews are intended to identify high-impact and high-risk vulnerabilities, improve testing and code coverage, and help maintainers address issues before exploitation.

Participating projects listed by the program include cURL, Jackson, and LLVM.

Submission Process

Review the criteria: applicants should read the Sovereign Tech Resilience criteria before beginning.
Create an account: registration is required to access and submit the application.
Submit the application: applications are checked against the program criteria and the services currently available.
Eligibility decision: ineligible projects receive a decline notice, while eligible projects receive an invitation to join the program.
Service waiting list: accepted projects are placed on a waiting list for the selected services, with waiting time determined by capacity and application volume.

Resources and Contact

Sovereign Tech Resilience criteria
Application platform
Application form preview
Bug Bounties and FOSS study
Application platform technical support: support@bugresilience.de