Open Source Policy

The Open Tech Foundation (OTF) develops and maintains open technologies with an emphasis on security, privacy, correctness, transparency, and long-term maintainability.

This policy establishes the requirements for software projects developed, maintained, or officially published by OTF.

• OTF-developed software must be released under an approved open-source license.
• The source code must be publicly available, subject to applicable legal and security restrictions.
• Users must be able to inspect, use, modify, and redistribute the software in accordance with its license.
• Project licenses must be clearly identified in the repository.
• License changes require explicit approval from the project maintainers and must comply with applicable legal obligations.

OTF aims to minimize external dependencies to reduce supply-chain risks, unnecessary complexity, and long-term maintenance burdens.

• Dependencies must be evaluated for security, licensing, maintenance status, and necessity.
• Projects should prefer minimal dependencies and avoid introducing them when the required functionality can reasonably be implemented internally.
• Dependencies must not be added without appropriate review.
• Known vulnerabilities and relevant dependency updates must be assessed and addressed.
• External projects must not be incubated as OTF projects.

All projects must follow OTF's applicable security and privacy policies.

• Security must be considered throughout design, development, testing, and maintenance.
• Software must not include undisclosed telemetry or hidden data collection.
• Projects must not collect usage data or transmit user information without an explicitly defined and approved justification consistent with OTF's privacy requirements.
• External services and network communication must be documented where applicable.

OTF emphasizes correctness, intentional changes, and maintainability over pursuing speed or performance at the expense of correctness.

• Releases must be performed by humans; automated release publication is not permitted.
• Projects must use Semantic Versioning where applicable.
• Release notes and changelogs must accurately describe the changes intentionally included in each release.
• Changes must undergo appropriate review and testing before release.
• Performance improvements must not compromise correctness, security, or privacy.

OTF welcomes technical collaboration with individuals, communities, and organizations, including enterprises.

However, corporate sponsorship of individual OTF projects is not permitted. Collaboration must preserve the project's independence and comply with OTF's governance and funding policies.

Projects maintained under OTF are expected to comply with this policy and other applicable OTF policies.

Exceptions must be explicitly reviewed and approved by the appropriate OTF authority. Exceptions must not be used to bypass legal obligations or essential security and privacy requirements.

OTF may review projects for compliance and require corrective action when necessary.

This policy applies to software projects developed, maintained, or officially published by the Open Tech Foundation.

OTF may update this policy as its projects, technical requirements, and governance practices evolve. The published version on the official OTF website is the authoritative version.