Guiding Principles

Securing the commons must not create the next lock-in.

Open source is the shared foundation of modern finance — and of modern life. In the AI era, defending it is urgent. How we defend it matters just as much as that we do.

A companion to the Linux Foundation's open letter on open source security. Read the open letter →

The same open source software runs the world's banks, insurers, hospitals, power grids and governments. It was built, and is largely maintained, in the open — by a global community, for everyone.

AI has not changed which vulnerabilities exist; it has changed how fast known ones are weaponised. A serious, well-funded response is arriving — much of it from individual vendors, each with its own approach. We welcome the investment and the urgency. But we have seen this pattern before: when something essential is fixed behind closed doors, access to the fix can quietly become a toll.

If the security of shared infrastructure is enclosed by any single company, we will have traded an open risk for a private one. That is a bargain the world should not accept.

A network is only as safe as its weakest link. Keeping the defence of the commons open is not idealism — it is sound risk management, and a neutral, sovereign alternative to depending on any one provider.

Our stand

Fix it in the open. Keep it free. Let it move.

This is the neutral home for open source supply-chain security, formed within FINOS and the Linux Foundation. Incubated in financial services, where the regulatory bar is highest, it is built to serve any regulated enterprise. We work in step with [CONFIDENTIAL LF PROJECT] — the Linux Foundation's cross-industry security response team — and alongside the vendors building important tools. We are not here to compete with them. We are here to make sure their good work stays portable, verifiable, and free of lock-in for the institutions, and the public, that depend on it.

Our principles

How open source security should work in the AI era

1

No monopolies, no capture

No single organisation should control how open source is patched. We strengthen the commons; we do not enclose it.

2

Upstream first

Wherever possible, fixes flow back to the original projects — free, public, and available to the whole community.

3

Coordination is the hard part

Anyone can write a patch. The real work is triage, testing and responsible disclosure — and that takes collective action.

4

Evidence with every fix

A fix should arrive with proof — its origin, contents and testing — so consumers can trust it and show their regulators they did.

5

Automation reduces toil, not accountability

AI can do more of the work, but a human still owns the decision to ship. Speed must never outrun responsibility.

6

Organise globally

Open source crosses every border. So must its defence — for institutions of every size, in every country.

In practice

What we commit to — and what we ask

We commit to

  • Offer fixes upstream and keep public forks public.
  • Attach a clear evidence trail to every fix as our tooling matures.
  • Set open standards so a fix is portable across any provider.
  • Make mutualised remediation affordable — a fraction of going it alone.
  • Stay neutral: vendors are partners, never gatekeepers.

We ask the industry to

  • Favour open, portable remediation over closed, single-source fixes.
  • Insist that the patches you buy can be verified and moved.
  • Contribute back to the projects you depend on.
  • Join a global effort — wherever you are, whatever your size.
  • Treat the security of the commons as shared, not proprietary.
Signatories

Institutions standing behind these principles

Leading global institutions and technology partners have signed in support of an open, non-lock-in approach to open source supply-chain security. Signing is a statement of principle — distinct from, and broader than, formal membership of the alliance.

Morgan Stanley
RBC
Deutsche Bank
Citi
Moderne

The signatory list is open and growing. To add your institution, get involved or email membership@finos.org.

Stand with us.

This effort is forming now, within FINOS. If you believe the defence of the open source commons should stay open, add your institution to it.

Get involved

A FINOS initiative, part of the Linux Foundation · complementary to [CONFIDENTIAL LF PROJECT] and the LF's open letter.

Built in the open. Governed by FINOS. For everyone.