Open Source Foundations Spend More on Compliance Than Development

The economics of open source have quietly inverted. For many foundations, the largest line item is no longer engineering but compliance: license scanning, legal review, export control, and the governance overhead that surrounds a project. This piece breaks down where the money goes, what it buys, and why the maintainers who fix critical bugs increasingly sit outside the budget.

The Compliance Tax on Open Source

Compliance work is not optional for a foundation that accepts corporate code. Every contribution carries a license, a copyright header, and potentially an export classification. Before a patch lands in a flagship project, someone has to verify that the contributor had the right to submit it. That verification is manual, repetitive, and expensive.

License scanning tools such as FOSSA and Black Duck are priced for enterprises, often in the tens of thousands of dollars per year for a mid-sized portfolio. Foundations that host hundreds of repositories need portfolio-wide scanning, which pushes costs toward six figures. The tooling is necessary, but it consumes budget that could otherwise pay for maintainer time.

Maintainers themselves absorb a share of the tax. A volunteer who reviews a pull request may also need to check a Developer Certificate of Origin, confirm a corporate contributor license agreement, and respond to a legal query about a transitive dependency. Those hours do not appear in any foundation's public accounting, but they reduce the time available for code review and security fixes.

Inside the Foundation Budget

The Linux Foundation reported annual revenue approaching $200 million in recent years, drawn largely from member dues and event sponsorships. A meaningful share of that revenue funds legal, compliance, and governance staff rather than software development. The foundation employs more people in program management and legal roles than in active coding roles for its hosted projects.

Standards efforts absorb millions. SPDX, the Software Package Data Exchange specification, and OpenChain, a compliance program standard, both require dedicated staff, tooling, and outreach. These are valuable projects, but they are infrastructure for compliance, not for shipping code. Their budgets are real and they compete with maintainer stipends for the same pool of member dues.

Member dues are the primary funding source for most large foundations. Companies pay to influence governance, gain early access to security disclosures, and demonstrate good citizenship. The result is a budget shaped by corporate legal departments, which prioritize indemnification and license clarity over the unglamorous work of patching a parser.

What Compliance Actually Costs

Automated license scanners are the visible cost. A single scanner license for a large repository can run into the tens of thousands annually, and many organizations run two or three tools because no scanner catches every license variation. False positives from scanners then require manual review, which is where the real labor sits.

Manual audits for every dependency are common in regulated industries. An audit traces each package back to its origin, verifies the license text, and checks for compatibility with the organization's distribution model. For a modern application with hundreds of transitive dependencies, an audit can take weeks and cost more than the original development sprint.

Export control reviews add another layer. Cryptographic libraries, for example, may require classification before they can be shipped in certain jurisdictions. A release can sit in review for days or weeks while legal teams determine whether a minor version bump changes the export status. Insurance premiums for intellectual property indemnity round out the bill; these policies are priced against the perceived license risk of the codebase.

The Maintenance Gap Widens

While compliance budgets grow, critical projects still run on volunteer effort. The Log4j vulnerability in late 2021 exposed how a logging library maintained by a handful of unpaid contributors sat inside thousands of enterprise applications. The maintainers had no budget for a security audit, no staff to triage the flood of reports, and no leverage to demand funding.

The XZ Utils backdoor disclosed in 2024 followed a similar pattern. A long-term maintainer, burned out and under-supported, handed over trust to a contributor who spent months building credibility before inserting malicious code. The project had no formal security review process because no one was paying for one.

Security patches lag behind disclosure for the same reason. A foundation may have a compliance team that can scan a release for license issues, but no equivalent team to backport a fix to an older branch. The compliance machinery is mature; the maintenance machinery is not. This site has argued that secure-coding roles trade feature velocity for incident leverage, and the same trade-off appears here at the foundation level.

Shifting Money Toward Maintainers

The Sovereign Tech Fund, backed by the German government, has directed millions toward core open source infrastructure, including direct payments to maintainers of libraries such as curl and OpenSSH. These grants are notable because they fund maintenance rather than compliance, and they pay individuals rather than institutions.

GitHub Sponsors and Open Collective provide lighter-weight channels. A maintainer can receive recurring donations without forming a legal entity, and companies can expense small contributions without a procurement cycle. The amounts are often modest, but they reach people who would otherwise receive nothing.

Corporate grants tied to deliverables are another model. A company might fund a specific security audit, a documentation sprint, or a compatibility fix with a defined acceptance criterion. Foundations have begun piloting direct maintainer stipends, though these programs remain small relative to compliance spending. The trade-off is real: compliance spending is defensible to a legal department, while maintainer stipends are harder to justify on a balance sheet.

Practical Steps for Funders

Audit your own compliance versus development spend. Pull the numbers for the last fiscal year and separate legal review, scanning tools, and governance staff from maintainer payments and security work. The ratio is often surprising.

Fund maintainers directly rather than routing money through overhead. A stipend paid to the person who triages your bug reports reaches the problem faster than a grant to a foundation's general fund. Use platforms like GitHub Sponsors or Open Collective where they fit your procurement rules.

Adopt lightweight license scanning for your own dependencies. A single well-configured scanner with a curated allowlist catches most issues without the cost of a full enterprise suite. Pair it with a policy that contributors sign off on their own contributions, which shifts the first line of review to the submitter.

Publish transparent budget breakdowns. Foundations that show how much goes to compliance versus maintenance give members the information they need to argue for reallocation. A related piece on this site notes that migrating off Lambda costs more than the idle concurrency did, and the same principle applies here: the hidden costs of a governance model eventually surface.

Tie grants to security outcomes. Fund a backport, a fuzzing harness, or a dependency update with a clear deliverable. That approach makes maintenance legible to finance teams and gives maintainers a concrete reason to keep going.

Why This Inversion Persists

Compliance spending is legible to the institutions that fund open source. A legal department can point to a scanner license, an audit report, or a standards membership as a concrete deliverable. Maintainer time is harder to quantify. When a foundation reports to its members, a line item for “license review” is straightforward; a line item for “kept a critical library from breaking” is not. This asymmetry favors compliance budgets even when the actual risk to the software supply chain lies in unpatched code.

There is also a structural mismatch in how foundations measure success. Compliance metrics—number of repositories scanned, percentage of dependencies with known licenses—are easy to collect and trend upward. Maintenance metrics—mean time to patch, number of active maintainers per project—are harder to define and often decline without triggering alarm. The result is that foundations optimize for what they can measure, and what they can measure is compliance.

Changing this requires funders to demand maintenance metrics alongside compliance reports. A foundation that publishes both its license scan coverage and its average time to patch critical vulnerabilities gives members a fuller picture. Some corporate members have started asking for exactly that, though the practice is not yet widespread. Until it is, the compliance tax will continue to crowd out the people who keep the code running.