Just this week, researchers disclosed PHP2Shell, a set of critical flaws in PHP itself. The reported bugs had been in the code for more than a decade, and reportedly AI models helped adapt a working exploit to WordPress, Drupal and Joomla in hours per target. The PHP team had about two months between the report and the patch, with a long list of industry partners helping, as the PHP Foundation describes. Many projects will have neither.
Today we're launching Enclave for Open Source. If you maintain a project that other people build on, you can apply for up to $10K in Enclave credits for security usage, along with hands-on help from our team.
What changed
Agent swarms now search codebases for vulnerabilities around the clock, and (almost) anyone can run one. A lot of work, security research and testing included, is limited only by the time people put into it. Agnetic swarms change that and the limit becomes how much compute you can point at the problem without hitting guardrails.
PHP2Shell shows what that looks like. According to the researchers, one person turned flaws that had sat in an open source project for over a decade into a working exploit in about a week, work that would once have taken a world-class team months.
A swarm finds vulnerabilities for the person defending the code and for the person attacking it. Code now ships faster than anyone can review it, so there is more to find and less time before someone looks and finds that vulnerability that was missed.
Why open source first
Libraries, frameworks, developer tools and infrastructure sit underneath most of the software people use. A flaw in a shared library ends up in every product built on it, and the maintainers are the ones who have to fix it. Many of them are a small team with no dedicated security team, and hiring one isn't realistic. PHP2Shell is a current example of the reach: the flaws are in PHP itself, so applications with secure code of their own were still exposed.
The projects with the widest reach often have the fewest people checking them. A swarm on the maintainers' side helps with that.
What the program includes
Enclave runs an AI audit and penetration test of your current codebase. Every finding is validated and comes with steps to reproduce it.
We review every pull request as your project changes, and report security issues privately to maintainers.
Maintainers get access to Enclave's agents to investigate risks and check that fixes hold, within the scope we agree on.
Enclave contributes up to $10K in credits for security usage to cover the work.
What stays with you
Testing starts with your permission. Findings stay private while you work on a fix, maintainers decide what ships and we coordinate any public disclosure with you.
Before any testing starts, we agree on the credits, what to test, what access we get, and how findings are handled. You don't need a big security team or a comprehensive security plan to apply. Agents handle the repetitive work, and maintainers make the decisions.
How to apply
Send us a link to your repository, a little about your role, and where security support would help. We'll take it from there. You can apply by email at support@enclave.ai, or through the contact page. Please don't include credentials or undisclosed vulnerabilities in your message.
We're starting with actively maintained, openly licensed projects that other projects rely on. If you maintain one, apply.