We're passionate about making open source software safer.

Our Story

Craig McLuckie (co-creator of Kubernetes) and Luke Hinds (creator of Sigstore) founded Stacklok in 2023 with the goal of helping developers produce and consume open source software more safely.

As malicious attacks on open source software continue to grow in number and become more sophisticated (like the recent XZ Utils incident), governments and organizations are calling for increased security and protection against these attacks. Yet open source maintainers—who are often unpaid volunteers, with other full-time jobs—lack the time to stay up to speed on security best practices, and access to freely available tools that can proactively keep their software safe.

On the consumer side, traditional security tools geared toward enterprise developers to help them secure their open source dependencies are often focused on CVEs as the main threat vector. Those tools may not detect malicious, deprecated, or abandoned open source projects, or projects that aren't following recommended security practices.

These are the challenges Stacklok aims to help solve.