Bug Bounties

We create bounties that will be paid out to anyone who finds a major security bug in any of our supported projects. These grants will incentivize the world to comb through the code of our projects and look for problems, dramatically improving the world's confidence in the integrity and security of the projects.

Professional Audits

We give grants to well-known professionals or organizations to audit code and look for bugs, clandestine back doors, or other errata that could compromise security. This adds another layer of oversight and integrity checking to reinforce the trust in all of our supported projects.

Direct Funding

We give grants to worthy projects to enable them to hire staff. This will facilitate code changes to implement bug fixes, and make improvements or upgrades to our supported projects, allowing them to advance in quality, features, or proper documentation of code at a much faster pace.

Latest News On OSTIF.org

OpenVPN Audit Updates – News – And More!

Fundraising Is Going Well, Progress Is Fast! We have had a lot of early success with our OpenVPN fundraiser, and the community response to the project has been tremendous with privacy advocates, VPN review sites, and VPN providers coming together to raise over $34,000 USD over the last two weeks. We think we are on

OSTIF is Beginning a Fundraiser for OpenVPN – Let’s Get it Audited!

OSTIF is Beginning a Fundraiser for OpenVPN - Let's Get it Audited! Edit: Updates about the progress of this fundraiser are here: https://ostif.org/openvpn-audit-updates-news-and-more/ Today marks the first day of our OpenVPN fundraiser. We are asking for your support to get one of the most widely used networking applications in the world audited. How you can support this effort: -Donate

OSTIF T-shirts Available to Donors!

Beautiful. Elegant. Stylish. Intelligent. These are the words that I, Derek Zimmer, and possibly someone else will describe you as when you are wearing our new OSTIF t-shirts! The design is a black shirt with the white OSTIF.org logo on the front, and the back is a negative of Snowden Document 20320108. This is the document that showed that

The VeraCrypt Audit Results

The QuarksLab audit of VeraCrypt has been completed, and this is the public release of the results. The quick and dirty: VeraCrypt 1.18 and its bootloaders were evaluated. This release included a number of new features including non-western developed encryption options, a boot loader that supports UEFI (modern BIOSes), and more. QuarksLab found: 8 Critical Vulnerabilities 3 Medium Vulnerabilities 15

MySQL 0-day Vulnerability Underscores the Need for OSTIF

On September 12th of this month, MySQL, the #1 database software in the world, suffered a 0-day exposure of a bug of the worst kind. It allows an authenticated remote attacker to take full control of any server running the software, regardless of the user's privileges in the database. This Escalation of Privilege vulnerability is a serious

OSTIF + QuarksLab Audit of VeraCrypt Completed – Phase II Begins

OSTIF + QuarksLab Audit of VeraCrypt Completed - Phase II Begins The audit of VeraCrypt has been completed, and the final report is being created over the coming days. The VeraCrypt developers have the preliminary results and we are working with both VeraCrypt and QuarksLab on the timetable for releasing results. Why aren't results released immediately? In

OSTIF, QuarksLab, and VeraCrypt E-mails are Being Intercepted

OSTIF, QuarksLab, and VeraCrypt E-mails are Being Intercepted As we have began the process of staging our audit, we have set up PGP encrypted communications between OSTIF, QuarksLab, and the lead developer of the VeraCrypt project. In these communications we have discussed vulnerability information, processes and procedures for reporting findings, and exchanged confidential information about

We Have Come to an Agreement to Get VeraCrypt Audited

OSTIF is proud to announce that we have come to an agreement to fully fund an audit of VeraCrypt. Using funds that were donated by DuckDuckGo and VikingVPN, we plan to hire QuarksLab to go over the code and search for vulnerabilities and backdoors. VeraCrypt is a crucial piece of open-source software that can encrypt

We Are Excited To Announce a New Member of Our Team!

We are proud to announce the addition of a new member of our team! Samara Renovato is joining us to help manage our PR and Social Media operations. She is a student at the University of Chicago studying Psychology. With a new focus on how people interact with one another in the contemporary digital