For maintainers
Your repository stays in your GitHub account; you connect it through a GitHub App.
A scan checks it against the standards and tells you file by file what to fix.
Once the platform approves the project, you keep it patched under public deadlines.
Each month an evaluation checks your duties against evidence and explains its result.
If you met them, you are paid from the project's funding, never per vulnerability.
Becoming a maintainer
- Apply with a public profile and accept the maintainer agreement.
- The platform reviews and approves the application.
- Onboard a project, or be assigned to one by its project administrator.
Payouts also need a verified payout destination and a tax status; CommonLayer never stores bank details.
In the documentation: Maintainer handbook: becoming a maintainer
Your repository
It stays in your account with its name, visibility and history. CommonLayer never pushes to it; with the managed permissions it adds and removes the maintainers the project appoints, and audits every change.
What the App can access (4)
- Administration: write — only to add and remove the collaborators CommonLayer manages: the maintainers the project appointed. It never changes settings and never removes someone it did not add.
- Contents: read — the manifest, Dockerfiles, workflows and charts for the checks, and the source for backups.
- Metadata: read, Actions: read and Pull requests: read — to observe builds and contributions.
- Issues: write is optional; the project's GitHub notification channel uses it to open issues, for example when a guardrail starts failing.
In the documentation: Project onboarding
The project template and the scan
New projects start from the template (templates/project-template), which already builds, scans, signs and registers a release. The onboarding scan checks your repository against it and the image and chart standards, names each failing rule with its file and line, and runs nothing. Fix, push, and propose once no required rule fails.
In the documentation: Project onboarding
Duties and deadlines
A project needs a primary and a secondary maintainer. You acknowledge and fix findings within deadlines set by severity, complete periodic tasks with evidence, and publish releases through CI.
Roles and what they are paid for (5)
| Role | Paid slot | Responsibilities |
|---|---|---|
| Primary | Yes (primary slot) | All responsibilities |
| Secondary | Yes (secondary slot) | All responsibilities |
| Security reviewer | If the policy has a slot for it | Security monitoring, acknowledgement, vulnerability triage, remediation coordination |
| Additional | If the policy has a slot for it | As set on the assignment |
| Temporary | If the policy has a slot for it | As set on the assignment, for a limited period |
In the documentation: Maintainer handbook: security duties and periodic tasks
How a month is decided
After each month you see a preliminary evaluation and can add evidence for two days. It is then final; you can appeal within 14 days, and an administrator decides.
The rules and when they fail (7)
| Rule | Fails when | Warns when |
|---|---|---|
| Acknowledgement | A critical or high finding was acknowledged late or not at all | Late medium/low acknowledgements exceed the tolerance |
| Remediation | A critical or high remediation deadline passed in the period without a fix or an approved exception | The same for medium/low beyond the tolerance |
| Outstanding | A critical or high finding is overdue at the end of the period | A medium or low finding is overdue at the end of the period |
| Private reports | A private security report was not acknowledged in time | — |
| Required tasks | Two or more required tasks were missed | One was missed |
| Release activity | No successful build for more than 45 days while upstream moved, or upstream lag over 30 days in a supported line | Lag over 14 days |
| Review responsiveness | — | Community pull requests waited more than 7 days for a first review beyond the tolerance |
In the documentation: Maintainer handbook: how eligibility is evaluated
Pay
Your slot amount comes from the project's published policy, split by the days you held it. If you were not eligible, the amount stays with the project as a public line with its reason. Payout runs need a second administrator's approval.
In the documentation: Funding model: paying people
Stepping down
You can step down at any time; no money moves. If the repository is in your account, you are asked to transfer it to the project's maintainers within 30 days; otherwise the project continues from CommonLayer's backup in a new repository.
In the documentation: Maintainer handbook: stepping down and replacement
Community contributors
Anyone can contribute fixes, reviews and documentation. Maintainers may propose a reward from the project's funding for an approved contribution; nobody approves a reward to themselves.
In the documentation: Funding model: community rewards