Safety, Security, and Privacy of Open-Source Ecosystems

The National Science Foundation (NSF), an independent federal agency dedicated to promoting the progress of science and advancing national welfare, administers the Safety, Security, and Privacy of Open-Source Ecosystems (Safe-OSE) program through its Directorates for Computer and Information Science and Engineering, STEM Education, and Technology, Innovation and Partnerships. The program responds to escalating threats facing open-source ecosystems (OSEs) and is rooted in NSF’s broader mission to bolster the scientific enterprise in the United States. Safe-OSE targets mature open-source ecosystems that have an established community of contributors, a substantial user base, and managing organizations that steer their development. The goal of the program is to improve the safety, security, and privacy of these ecosystems, particularly addressing vulnerabilities that the managing organizations currently lack resources to fix. These vulnerabilities may be technical—such as flaws in code or data leakage risks—or socio-technical, such as those arising from supply chains or insider threats. The funding aims to increase the resilience and responsiveness of OSEs against such threats, ultimately strengthening their national and societal impact. Eligible applicants include U.S.-based institutions of higher education, state and local governments, tribal nations, non-profit and for-profit organizations with proven scientific or educational capabilities. Key eligibility rules stipulate that principal investigators must be U.S.-based and employed by the proposing organization. The program allows up to two preliminary proposals per organization, and selected projects can be funded through cooperative agreements for up to $1.5 million over two years. Applicants are required to submit a preliminary proposal by January 14, 2025, with full proposals due by April 22, 2025. Proposals must include detailed project descriptions, development and evaluation plans, and letters of collaboration from third-party stakeholders. Proposals are submitted via Research.gov or Grants.gov and must comply with the NSF Proposal & Award Policies & Procedures Guide (PAPPG). Required supporting documents include a mentoring plan (if postdoctoral or graduate students are involved), a data management plan, and budget justifications for all line items. Projects will be evaluated based on NSF’s standard merit review criteria—Intellectual Merit and Broader Impacts—as well as specific Safe-OSE criteria like significance of vulnerabilities, societal impact, and the robustness of the proposed mitigation strategies. A reverse site visit or external review will assess progress at the end of the first year to determine eligibility for the second-year funding increment. For general inquiries, applicants can contact the program at safeose@nsf.gov or 703-292-7529. The program also encourages early submissions to allow time for error correction, especially when applying via Grants.gov.

Ensure thorough understanding of threat landscape, include strong third-party letters of collaboration, adhere strictly to budget and eligibility guidelines, submit early.