# The Burden of Security in Software Maintenance

Source: https://www.testifysec.com/blog/security-burden-maintenance/

Author: John Kjell

Published: 2024-10-15

Discussion on the significant burden maintainers face when securing open-source projects and balancing security with community needs.

From the event archive

This is an event archive. Product names, affiliations, and demonstrations reflect the recording, not the current release. The overview is editorial context, not a transcript or a product support commitment.

- [Current TestifySec docs →](https://www.testifysec.com/docs)
- [Trust architecture →](https://www.testifysec.com/docs/cilock/trust)

## Listen to the conversation

The player loads from Podbean when you choose to play.

[Open the recording at its source ↗](https://www.podbean.com/player-v2/?share=1&download=1&rtl=1&fonts=Arial&skin=3267a3&btn-skin=1b1b1b&multiple_size=315&size=300&order=serial&filter=all&limit=5&season=all&tag=all&font-color=ffffff&logo_link=podcast_page&i=y58qu-167a2e2-pb)

## Questions to take into the discussion

- The maintenance cost of security tooling.
- Supporting contributors and maintainers.
- Keeping security requirements practical for a project.

Use these as an editorial guide while watching or exploring the topic. They are not quotations or a verified transcript of the session.

## Apply the ideas to a current workflow

For an implementation, start with the [shared documentation](https://www.testifysec.com/docs). CI/lock captures the work, Pushgate checks the push, and the platform manages gates and technical control evidence. Check the [support matrix](https://www.testifysec.com/docs/concepts/support-matrix) for the release and environment you intend to use.

A signed statement can establish attribution and detect alteration under a configured trust model. It does not establish that the producer reported honestly or that a whole compliance framework is satisfied. The [trust architecture](https://www.testifysec.com/docs/cilock/trust) explains those boundaries.