Safety, Security, and Privacy of Open-Source Ecosystems | 24 608

Opportunity Information: Apply for 24 608

The National Science Foundation (NSF) is offering a discretionary grant opportunity called Safety, Security, and Privacy of Open-Source Ecosystems (Safe-OSE), Funding Opportunity Number 24-608. The core idea behind this program is that modern open-source ecosystems can be attacked not only through flaws in the product itself, but also through weaknesses in the way the product is built, tested, integrated, and delivered to users. In other words, an attacker may exploit vulnerabilities in source code, build pipelines, dependencies, release processes, or community practices and then impact anyone who relies on that open-source product, whether that is an individual user, an organization, or another downstream product.

Safe-OSE is aimed at open-source ecosystems (OSEs) that need to tackle real safety, security, and privacy gaps they currently do not have the resources to address on their own. NSF is explicitly looking for proposals that deal with both technical vulnerabilities (for example, code defects, exploitable design issues, and side-channel vulnerabilities) and socio-technical vulnerabilities (for example, supply chain compromise, insider threats, social engineering, and governance or process weaknesses that attackers can manipulate). A key point is that NSF is not limiting this to traditional software projects. While many OSEs are software-based, Safe-OSE applies to any open-source ecosystem, including those centered on scientific methods, models, and processes; manufacturing processes and process specifications; materials formulations; programming languages and formats; hardware instruction sets; system designs or specifications; and data platforms. The intention is to recognize that open source now underpins far more than just code repositories, and security or safety failures can propagate broadly across research, industry, and public infrastructure.

The program is also open to ecosystems that were not originally funded by NSF's earlier Pathways to Enable Open-Source Ecosystems (POSE) program. In practical terms, this means NSF is inviting a wide range of established or emerging open-source efforts to propose targeted work that will materially improve the ecosystem's security posture and resilience. Funding is meant to support concrete improvements that strengthen the open-source product and its supply chain, and also to improve the ecosystem's ability to manage risk over time. That includes developing better capabilities to prevent, detect, and respond to attacks, breaches, and future threats, rather than treating security as a one-time patching effort.

Eligibility to submit proposals is limited to specific categories of U.S.-based organizations. Eligible applicants include U.S.-based for-profit organizations (including small businesses) that demonstrate strong capabilities in scientific or engineering research or education; non-profit, non-academic organizations such as independent museums, observatories, research labs, and professional societies located in the U.S. and directly tied to research or educational activities; state and local governments; federally recognized Tribal Nations (as defined by the Federally Recognized Indian Tribe List Act of 1994); and accredited U.S. Institutions of Higher Education (two-year and four-year institutions, including community colleges) submitting on behalf of their faculty.

The opportunity also sets clear rules for who can serve as Principal Investigator (PI), and those rules differ depending on the type of applicant organization. For Institutions of Higher Education, by the proposal deadline the PI, any co-PI, and other Senior/Key Personnel must hold one of the following at a U.S.-based campus: a tenured or tenure-track position; a primary, full-time, paid appointment in a research or teaching role; or a staff leadership role in an Open-Source Program Office (or an equivalent function). Exceptions may be allowed for family or medical leave if the submitting institution determines that applies. Individuals whose primary appointments are at overseas branch campuses of U.S. institutions are not eligible to serve in these roles under this program. Researchers from foreign academic institutions may participate as collaborators or Senior/Key Personnel when they bring essential expertise, but they may not receive NSF funding through the award.

For all other eligible proposing organizations (such as companies, non-profit non-academic organizations, governments, or Tribal Nations), the PI must be an employee of the proposing organization, normally reside in the United States, and carry out PI responsibilities in their capacity as an employee. The PI is allowed to perform PI duties while temporarily outside the U.S., but individuals whose primary appointments are with non-U.S.-based non-profits or non-U.S.-based for-profit organizations are not eligible.

Administratively, the opportunity is issued by the National Science Foundation under a grant funding instrument, categorized under science and technology and other research and development. The original closing date listed is 2025-04-22. The notice lists multiple CFDA numbers associated with NSF research programs (47.041, 47.049, 47.050, 47.070, 47.074, 47.075, 47.076, 47.079, 47.083, 47.084). Details like the award ceiling and expected number of awards are not specified in the provided data. Overall, Safe-OSE is designed to push measurable, ecosystem-level improvements in how open-source projects prevent and handle security, safety, and privacy threats, with a strong emphasis on addressing both code-level weaknesses and the real-world human and process risks that often enable attacks.

• The National Science Foundation in the science and technology and other research and development sector is offering a public funding opportunity titled "Safety, Security, and Privacy of Open-Source Ecosystems" and is now available to receive applicants.
• Interested and eligible applicants and submit their applications by referencing the CFDA number(s): 47.041, 47.049, 47.050, 47.070, 47.074, 47.075, 47.076, 47.079, 47.083, 47.084.
• This funding opportunity was created on 2024-09-20.
• Applicants must submit their applications by 2025-04-22. (Agency may still review applications by suitable applicants for the remaining/unused allocated funding in 2026.)
• Eligible applicants include: Others.

Apply for 24 608

[Watch] Creating a grant proposal using the step-by-step wizard inside the applicant portal: