Google has a program where you can submit patches to OSS projects (including libxslt) https://bughunters.google.com/about/rules/open-source/4928084514701312/pa

Google has a program where you can submit patches to OSS projects (including libxslt) https://bughunters.google.com/about/rules/open-source/4928084514701312/patch-rewards-program-rules https://bughunters.google.com/about/rules/open-source/492808... The patches need to fix a systemtic design flaw (which seems like you are trying to do). You are eligible even if you are a contributor: > Q: I'm a core developer working on one of the in-scope projects. Do my own patches qualify? > A: They most certainly do. Additionally, github has: https://resources.github.com/github-secure-open-source-fund/ https://resources.github.com/github-secure-open-source-fund/ Companies have changed after seeing the log4j incident and are open to funding open source security (but we still need more)