Skip to main content

​
GitHub Sponsors tiers (proposal)

Project page. For users and companies asking “how can I support Penthera, and what does that buy?”
Status: live on GitHub Sponsors since 28 October 2026. This page is the source of truth for what each tier gives; the tier descriptions on GitHub follow it. Prices are in US dollars because GitHub Sponsors tiers are priced in USD.

​
Tiers

One-time sponsorships of any amount are also welcome.

​
What sponsorship pays for

Maintainer time. Specifically, in rough order:
  1. Keeping detection rules current: new AI provider key formats, new supply chain attack patterns, new checks for developer tooling.
  2. Security fixes and releases for Penthera itself.
  3. The roadmap in ROADMAP.md.

​
What sponsorship does not buy

Written down so nobody is surprised:
  • No influence over findings. Sponsors’ products are scanned and reported the same way as everyone else’s. A sponsor cannot have a rule removed or softened.
  • No roadmap control. The quarterly call is a conversation, not a vote. Priorities stay set by evidence of what users need.
  • No support contract or SLA. Penthera is maintained part-time. Bug reports are handled in public issues, in the order the maintainer judges best.
  • No early or private access to vulnerability information. Security issues follow SECURITY.md for everyone.
  • No certification or endorsement. A logo in the README means the company supports the project. It does not mean Penthera has assessed or approved that company’s security, and the README will say so next to the logos.
  • No change to the principles. No telemetry, offline first, MIT license. Sponsorship will never add a feature that sends data off the user’s machine.

​
Logo rules (Company tier)

  • One logo, at most 160 px wide, in the README “Sponsors” section, linked to the company site.
  • Logos are listed in the order sponsorships started.
  • The logo is removed in the first README update after a sponsorship ends.
  • The maintainer may decline or end a sponsorship, for example for a company whose product is malware or surveillance tooling. Any payment for a month not yet started is then refunded.

​
Fees and money, for transparency

From the GitHub Sponsors docs: GitHub charges no fees on sponsorships from personal accounts. Sponsorships from organization accounts carry up to 6% in fees (3% card processing and 3% GitHub service fee; invoiced billing avoids the card fee). Tier prices cannot be edited after publishing; a tier has to be retired and replaced. Source: https://docs.github.com/en/sponsors/receiving-sponsorships-through-github-sponsors/about-github-sponsors-for-open-source-contributors The maintainer intends to publish a short yearly note on total sponsorship income and what it paid for. Penthera stays free and complete. Pro is a separate experiment that measures whether teams need more; sponsorship is not tied to it (GOVERNANCE.md).

​
Open questions for the maintainer

  • Are $100 and $500 right for startups and companies? They are deliberately modest. Raise them if the first sponsors suggest so.
  • Is a quarterly call something you want to commit to? If not, drop it from the Company tier before publishing, because published tiers cannot be edited.
  • Check with a tax adviser how sponsorship income should be reported in the Netherlands before the first payout.