OpenSSF Community Day Europe 2026

We've all been new contributors at some point. You know the learning curve - best practices established before your first PR, specs that have been evolving for years. Should PRs require 3 reviewers? Do I need MFA? What are the actual threats to this project? Contributors need a clear way to understand not just how to contribute, but how to contribute securely.

The OpenSSF Gemara Project provides a standardized model and tooling to help projects define capabilities, identify threats, and document the controls that prevent them, structured across a 7-layer architecture. For maintainers shipping open source into the EU under the Cyber Resilience Act, structured governance isn't optional.