# Making $500 from Open Source Software — Liran Tal

By all means this is not a joke, nor a spam.You can really, truly, make $500 dollars if you are able to just find one security…

Canonical: https://lirantal.com/blog/making-500-from-open-source-software-108c134e2651

By all means this is not a joke, nor a spam.
You can really, truly, make $500 dollars if you are able to just find one security vulnerability in the [qmail](https://cr.yp.to/qmail/guarantee.html) project.

![](/images/blog/0__wZ__oTyBoSFE4FCzV.png)

In all truth — this is the story of Security in Open Source Software.
More precisely, this is the story of qmail’s security guarantee:

> In March 1997, I offered $500 to the first person to publish a verifiable security hole in the latest version of qmail: for example, a way for a user to exploit qmail to take over another account.

> My offer still stands. Nobody has found any security holes in qmail. 
> [D. J. Bernstein](https://cr.yp.to/djb.html)

How about that for quality control in Open Source Software?

We can learn a lot about effective security guidelines from DJB, who is also the man behind the legendary DNS tool djbdns.

DJB covers 7 principles that lead him to create a secure quality software:[https://cr.yp.to/qmail/guarantee.html](https://cr.yp.to/qmail/guarantee.html) — A must read for any software engineer!

Which secure software guidelines are you following?
Which software project do you find secure at this level?

## More writing

[All writing →](/blog)

*   Sep 5, 2026

    ### [Self-Hosting Hermes Agent with Matrix E2EE on Proxmox](/blog/self-host-hermes-agent-matrix-e2ee-proxmox)

*   Aug 2, 2026

    ### [The Practical Second Brain: Building an LLM-Operated Markdown Knowledge Graph](/blog/practical-second-brain-llm-markdown-knowledge-graph)

*   Aug 1, 2026

    ### [Building a Second Brain with LLMs and AI Agents](/blog/building-second-brain-llms-ai-agents)


* * *

Liran Tal is the author of the book [Node.js Secure Coding: Defending Against Command Injection Vulnerabilities](https://www.nodejs-security.com/)

[Start Building Secure Node.js Applications ↗](https://www.nodejs-security.com/)

 [![](/_astro/nodejs-secure-coding-book-3d-style.DiTWpzFs_Z3c7s1.png)](https://www.nodejs-security.com/)