Emelia 👸🏻 @thisismissem@hachyderm.io
Public

This is a program that I've been championing within @nivenlyThe Nivenly Foundation over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.

You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.

I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)

RE: hachyderm.io/@nivenly/11426849

The Nivenly Foundation (@nivenly@hachyderm.io)

Over the past year, we've been thinking about how we can improve the security of the Fediverse to provide a safer, more trustworthy experience for people of the Fediverse. Today we're launching a time-and-funds limited Fediverse Security Fund, where we will pay researchers and contributors for the responsible disclosure of security vulnerabilities in open-source Fediverse software. We're starting small as an experiment to gauge interest, figure out our processes, and eventually decide if/how to expand this program and make it more permanent. If you're a security researcher or upstream contributor, join us in making the Fediverse a safer place. You can read more about this program on our blog: https://nivenly.org/blog/2025/04/01/nivenly-fediverse-security-fund/

hachyderm.io · Hachyderm.io

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://hachyderm.io/users/thisismissem/statuses/114268511720117041 on your instance and quote it. (Note that quoting is not supported in Mastodon.)