Comment Comment by securesaml Google has a program where you can submit patches to OSS projects (including libxslt) https://bughunters.google.com/about/rules/open-source/492808...The patches need to fix a systemtic design flaw (which seems like you are trying to do).You are eligible even if you are a contributor:> Q: I'm a core developer working on one of the in-scope projects. Do my own patches qualify?> A: They most certainly do.Additionally, github has: https://resources.github.com/github-secure-open-source-fund/Companies have changed after seeing the log4j incident and are open to funding open source security (but we still need more) parent securesaml 1 year ago
The patches need to fix a systemtic design flaw (which seems like you are trying to do).
You are eligible even if you are a contributor:
> Q: I'm a core developer working on one of the in-scope projects. Do my own patches qualify?
> A: They most certainly do.
Additionally, github has: https://resources.github.com/github-secure-open-source-fund/
Companies have changed after seeing the log4j incident and are open to funding open source security (but we still need more)