We're passionate about making open source software safer.

Our Story

The origin of Stacklok began with the idea that signing and verifying software can and should be dramatically simpler. Consuming software from an unknown origin represents a huge security risk—and yet the majority of open source software isn't signed today, likely because the practice of doing so has been historically cumbersome.

Stacklok CTO Luke Hinds founded the open source project Sigstore in 2020 as a way to make this process easier. Sigstore provides free certificates and tools to automate and verify signatures of source code, and makes those certificates visible, discoverable, and auditable.

In the light of Executive Order 14028, it's clear that enterprise developers and open source communities will start to be held to stricter standards for supply chain security—beyond just signing their source code. And yet developers and communities still don't have many freely accessible tools to help them build safer software, and accurately evaluate dependency safety.

Enter Stacklok. We're building free-to-use products to help developers make better assessments about the dependencies they're using, and clear assertions about the security of the software they're building.