The individuals involved often work for little or nothing. Paul Eggert, a UCLA teacher, maintains the main time-zone file used across Linux-based operating systems pro bono. Denis Pushkarev handles core-js, which he estimates is used by half of the busiest websites in the world, and was once criticised by the community simply for adding a message to the installer asking for help or a job. Behdad Esfahbod does most of the work on HarfBuzz, which shapes text in Middle Eastern languages, with no public or corporate funding mentioned.

History suggests the risk is real. Shellshock, the 2014 vulnerability in the Bash shell present on Linux, macOS and Unix-type systems, traced back to a line of code from 1989, in software almost exclusively maintained by Chet Ramey. ImageMagick was exploited for remote code execution in 2016, and recent years brought Log4Shell in 2021, a libwebp zero-day in 2023 and the 2024 compromise of the xz compression library.

There are counterexamples. Curl's Daniel Stenberg is now paid to work on the project full-time, and the team has grown to 11 with funding from Open Collective and Germany's Sovereign Tech Agency. That agency also funds Log4j, OpenSSL, FFmpeg and OpenSSH, apparently informed by past debacles. The report's implicit argument is that companies whose products benefit most from this software should treat donations as investments, particularly when AI agents can find exploitable vulnerabilities within hours.