Archive — US — techcrunch
A new security fund opens up to help protect the fediverse
The Nivenly Foundation has launched a security fund to improve the protection of the fediverse, offering payouts for reporting vulnerabilities in apps like Mastodon and Pixelfed. This initiative responds to security issues stemming from independent operators lacking security expertise and aims to educate project leads on responsible vulnerability disclosure practices.
Key points
- The Nivenly Foundation launches a security fund for the fediverse to address security vulnerabilities.
- Payouts are offered for responsibly disclosed vulnerabilities—$250 for severity 7.0-8.9 and $500 for 9.0 and above.
- Many fediverse servers are run by operators without security backgrounds, highlighting the need for security education.
- The program aims to establish best practices in vulnerability disclosure to prevent exploitation.
- The fund is in a limited trial phase following a vulnerability discovered in Pixelfed.
- Mastodon's Hachyderm server acted to protect users by severing ties with Pixelfed instances that hadn't updated for vulnerabilities.
Why it matters
- The rise of decentralized platforms reflects a broader trend towards open-source technology in 2025, pushing for better security measures.
- The challenge of securing open-source software is a growing concern as independent developers may lack resources and expertise.
- The structure of the fediverse and its reliance on independent operators mirrors the development of other decentralized protocols in tech.
This initiative by the Nivenly Foundation represents an essential step towards enhancing the security of the fediverse, promoting best practices among developers and helping safeguard user data against potential threats.