How Secure Is Academic Open Source? Insights From the UC OSPO Network

Explore the security landscape of academic open source software through a comprehensive analysis of the University of California's GitHub projects. Learn about the unique security challenges facing academic institutions, where research-focused developers often lack training in secure coding practices, leaving widely-used scientific tools vulnerable and poorly maintained. Discover how University Open Source Program Offices (OSPOs) work to bridge these gaps by promoting sustainability and implementing better development practices. Examine the methodology used to build a UC-wide dataset of GitHub projects and assess their security posture using OpenSSF Scorecards, static analysis tools, contributor centralization metrics, and dependency analysis. Review preliminary findings that reveal both tooling limitations and opportunities for OSPOs to better support researchers in creating safer, more sustainable academic open source software. Understand the reproducible assessment methods that other universities can adopt to evaluate their own open source ecosystems and learn about the ongoing efforts to foster security awareness in academic software development communities.