Safety, Security, and Privacy of Open-Source Ecosystems | 24 608

Safe-OSE (NSF 24-608) FAQs

What is the Safe-OSE funding opportunity?

Safety, Security, and Privacy of Open-Source Ecosystems (Safe-OSE) is a discretionary grant opportunity from the National Science Foundation (NSF), Funding Opportunity Number 24-608. It supports work that materially improves the safety, security, and privacy posture of open-source ecosystems and the ways those ecosystems prevent, detect, and respond to attacks over time.

What problem is Safe-OSE trying to solve?

Safe-OSE is based on the idea that modern open-source ecosystems can be compromised not only through flaws in the product itself, but also through weaknesses in how the product is built, tested, integrated, and delivered. Attackers may exploit vulnerabilities in source code, build pipelines, dependencies, release processes, or community practices, and those failures can affect anyone downstream who relies on the open-source product.

What kinds of vulnerabilities does Safe-OSE want proposals to address?

NSF is explicitly looking for proposals that address both technical vulnerabilities (such as code defects, exploitable design issues, and side-channel vulnerabilities) and socio-technical vulnerabilities (such as supply chain compromise, insider threats, social engineering, and governance or process weaknesses that attackers can manipulate).

Is Safe-OSE limited to traditional software open source projects?

No. While many open-source ecosystems are software-based, Safe-OSE applies to any open-source ecosystem, including ecosystems centered on scientific methods, models, and processes; manufacturing processes and process specifications; materials formulations; programming languages and formats; hardware instruction sets; system designs or specifications; and data platforms.

What does NSF mean by an "open-source ecosystem" (OSE) in this program?

Based on the opportunity description, an open-source ecosystem is broader than a single repository or codebase. It includes the open product itself plus the surrounding dependencies, build and release processes, integration paths, distribution mechanisms, and community or governance practices that influence how the open-source work is produced and adopted.

What types of improvements is Safe-OSE intended to fund?

Funding is intended to support concrete improvements that strengthen the open-source product and its supply chain, and improve the ecosystem's ability to manage risk over time. This includes building better capabilities to prevent, detect, and respond to attacks, breaches, and future threats, rather than treating security as a one-time patching effort.

Who is the program meant to help?

Safe-OSE is aimed at open-source ecosystems that have real safety, security, and privacy gaps and that currently do not have the resources to address those gaps on their own.

Do you need to have been funded by NSF's POSE program to apply?

No. The opportunity is open to ecosystems that were not originally funded under NSF's earlier Pathways to Enable Open-Source Ecosystems (POSE) program. NSF is inviting a broad range of established or emerging open-source efforts to propose targeted work to improve security posture and resilience.

Who is eligible to submit a proposal?

Eligibility is limited to specific categories of U.S.-based organizations. Eligible applicants include:

• U.S.-based for-profit organizations (including small businesses) with strong capabilities in scientific or engineering research or education
• U.S.-based non-profit, non-academic organizations (for example, independent museums, observatories, research labs, and professional societies) directly tied to research or educational activities
• State and local governments
• Federally recognized Tribal Nations (as defined by the Federally Recognized Indian Tribe List Act of 1994)
• Accredited U.S. Institutions of Higher Education (two-year and four-year institutions, including community colleges) submitting on behalf of their faculty

Are individuals allowed to apply directly?

The provided information describes eligibility in terms of organizations (companies, non-profits, governments, Tribal Nations, and Institutions of Higher Education). It does not describe individual applicants applying directly outside an eligible proposing organization.

What are the PI eligibility rules for Institutions of Higher Education?

For Institutions of Higher Education, by the proposal deadline the PI, any co-PI, and other Senior/Key Personnel must hold one of the following at a U.S.-based campus:

• A tenured or tenure-track position
• A primary, full-time, paid appointment in a research or teaching role
• A staff leadership role in an Open-Source Program Office (or an equivalent function)

Exceptions may be allowed for family or medical leave if the submitting institution determines that applies.

Can personnel based at overseas branch campuses of U.S. universities serve as PI or co-PI?

No. Individuals whose primary appointments are at overseas branch campuses of U.S. institutions are not eligible to serve as PI, co-PI, or other Senior/Key Personnel roles under this program.

Can foreign academic researchers participate?

Yes, researchers from foreign academic institutions may participate as collaborators or Senior/Key Personnel when they bring essential expertise. However, they may not receive NSF funding through the award.

What are the PI eligibility rules for companies, non-profits, governments, or Tribal Nations?

For all other eligible proposing organizations (such as companies, non-profit non-academic organizations, governments, or Tribal Nations), the PI must be an employee of the proposing organization, normally reside in the United States, and carry out PI responsibilities as an employee.

Can the PI be temporarily outside the United States while performing PI duties?

Yes. The PI is allowed to perform PI duties while temporarily outside the U.S., as described in the opportunity.

Who is not eligible to serve as PI for non-university applicants?

Individuals whose primary appointments are with non-U.S.-based non-profits or non-U.S.-based for-profit organizations are not eligible under this program.

What is the funding instrument and agency for Safe-OSE?

The opportunity is issued by the National Science Foundation (NSF) and uses a grant funding instrument. It is categorized under science and technology and other research and development.

What is the Funding Opportunity Number?

The Funding Opportunity Number is 24-608.

What is the application deadline?

The provided information lists an original closing date of 2025-04-22.

Are the award ceiling and expected number of awards provided?

No. In the provided information, details such as the award ceiling and the expected number of awards are not specified.

What CFDA numbers are associated with this opportunity?

The notice lists multiple CFDA numbers associated with NSF research programs: 47.041, 47.049, 47.050, 47.070, 47.074, 47.075, 47.076, 47.079, 47.083, 47.084.

Does Safe-OSE focus only on fixing existing bugs?

No. The description emphasizes improving an ecosystem's ability to manage risk over time, including capabilities to prevent, detect, and respond to attacks and future threats, rather than treating security as a one-time patching effort.

What kinds of attack surfaces does Safe-OSE recognize in open source?

Safe-OSE recognizes that attackers may target source code, build pipelines, dependencies, testing and integration processes, release processes, delivery mechanisms, or community practices and governance that influence how open-source work is developed and distributed.

Why does Safe-OSE emphasize socio-technical risks?

The program description highlights that real-world compromises often exploit human and process weaknesses (for example, social engineering, insider threats, governance gaps, and supply chain compromise), not just code defects. Safe-OSE seeks proposals that address these socio-technical vulnerabilities alongside technical ones.