The Software Stewardship Lab is a newly established, non-profit applied research lab dedicated to ensuring the stability and security of the global Open Source software ecosystem. Recognizing that critical societal infrastructure such as healthcare, transportation, and the internet relies heavily on Open Source software, the lab focuses on addressing the systemic challenges currently threatening this ecosystem, including maintainer burnout, insufficient institutional funding, and supply chain security vulnerabilities.

The lab was founded by a team of experienced Open Source experts, including Vlad-Stefan Harbuz, Andrew Nesbitt, and Miranda Heath. The organization operates as a Scottish non-profit (SC893294), with values grounded in public good, accessibility, and systemic improvement. All research outputs, including software, APIs, reports, and peer-reviewed papers, are provided as public-benefit resources. The lab provides a neutral, non-corporate space for investigating the human and technical factors that impact the sustainability of critical software projects.

Some of the key features are:

• Supply Chain Observability: Development of an observatory to monitor critical Open Source packages, identify insecure dependencies, and track hidden binary dependencies in real time.
• Maintainer Well-being: Ongoing research into the structural causes of maintainer burnout, providing data-driven recommendations and companion reports to improve working conditions.
• Sustainability Research: Extensive reporting on Open Source funding, project governance, and the effectiveness of current foundation models for supporting developers.
• Technical Tooling: Open-source tools developed to help maintainers manage dependency histories, scan for vulnerabilities, and navigate the complex requirements of modern software ecosystems.
• Interdisciplinary Approach: Integration of psychological, economic, and technical perspectives to address the social and policy dimensions of Open Source management.

Operationally, the lab functions as a research entity that produces documentation and tools to support the broader developer community. Its team members conduct original research, synthesize data from various registries, and engage with the academic and developer communities to advocate for systemic changes. The lab maintains full financial transparency through Open Collective, ensuring all received contributions are used to advance its research mission.

Some common use cases include:

• Risk Mitigation: Organizations use the lab's research and observational tools to identify unmaintained or abandoned 'Bernie' packages within their dependency trees.
• Policy Development: Foundations and OSPOs utilize the lab's reports on funding and governance to design more effective contribution strategies and measure the impact of their investments.
• Security Auditing: Security professionals rely on the lab's insights into supply chain threats and package manager design tradeoffs to protect their infrastructure.
• Community Support: Maintainers access the lab's burnout research and mental health resources to better understand their own experiences and advocate for sustainable work environments.