Why we're funding research into making the web safer

We're launching a research fellowship.

The Opsec Research Fellowship funds independent security researchers to find vulnerabilities in critical software and publish the work. We cover the full cost of the research for every fellow who ships public content on what they find, and researchers who deliver strong results receive up to $3,000 in early Opsec allocation.

Why fund independent research?

Critical software needs more scrutiny, and researchers need the time and resources to look.

A huge share of the internet runs on a handful of shared components: parsers, runtimes, cryptography libraries, package tooling, the infrastructure underneath everything else. A flaw in one of them does not stay contained. It surfaces in every product built on top.

Those components are also where the fewest people are looking. Deep review is slow, expensive and rarely anyone’s full-time job. The researchers best equipped to do it are often doing it on nights and weekends, paying for their own compute. We want to change that.

What fellows do

Fellows put Opsec’s fleet of autonomous agents to work on the software they think deserves a closer look. The agents read, probe and test the target in parallel. The researcher steers the work, decides what matters and confirms every finding.

The loop is simple: find the vulnerability, prove it with a working exploit, then release the research and content so others can learn from it. Write-ups, talks, threads, videos, proof-of-concept code. Whatever format teaches it best.

What we cover

Full research costs. Fellows get an Opsec account with the compute they need to run serious, sustained research, paid for by us, for as long as they keep shipping public work on their findings.

Up to $3,000 in early Opsec allocation for researchers who deliver strong results. The best work in the program should be rewarded, and we want our most effective researchers to have a real stake in what we are building.

The credit is always yours. Your name goes on the advisory, the CVE and the write-up.

Disclosure first, then publish

Publishing matters, but not before it is safe. Every finding goes to the affected maintainer or vendor first, with a standard 90-day window to ship a fix. Once that window closes, or the fix is out, fellows publish, and we will feature the strongest work here on the Opsec Research blog.

Who should apply

Proven previous research is required to apply: published CVEs, advisories, write-ups or talks that show how you work. Spaces are limited so every fellow gets real support from our team.

Apply at runopsec.com/research/fellowship/apply with your name, email and links to your previous research. Tell us what you would like to look at first. If you have spent years finding the bugs nobody else was looking for, we want to give you the resources to find more.