Tidelift helps organisations manage the risk of the open source packages in their software. It pays the maintainers of those packages to follow secure development practices and to document licences, releases and vulnerabilities, and sells the resulting package intelligence to enterprises through the Tidelift Subscription.
Most applications depend on open source written by volunteers with no obligation to keep it secure or maintained. Tidelift’s model ties the two sides together: subscription fees fund the maintainers of the exact packages a customer uses, and the information those maintainers supply tells the customer which packages are healthy, correctly licensed and free of known vulnerabilities.
At A Glance
| Vendor | Tidelift |
|---|---|
| Category | Open source package intelligence and maintainer partnerships |
| Deployment | Service accessed through a web UI, APIs and a CLI |
| Customers | Cisco, Fannie Mae, U.S. Air Force |
| Ownership | Sonar (definitive agreement to acquire, announced December 2024) |
| Market classification | DevSecOps |
What Tidelift Does
Tidelift’s view is that maintainers should be paid for working to the standardised secure development practices enterprises expect, and that the information they supply is the most reliable signal of whether a package is safe to use. Instead of every enterprise evaluating packages by hand and reacting to each vulnerability alert, the maintainers of the packages it depends on document licences, releases and vulnerabilities once, and that data reaches every subscriber. Partnered projects include jackson-databind, minimist, urllib3, SockJS, Pillow, Mongoose and Apache Commons, and their data is combined with information from public ecosystems.
Products
Tidelift Subscription
The Tidelift Subscription is for engineering and security teams that need to decide which open source packages are safe to build on. It covers:
| Package health | Whether a package is developed and maintained well enough for application development |
|---|---|
| Lifecycle warnings | Deprecated or abandoned packages and approaching end of life dates |
| Licence checks | Whether packages conform to the organisation’s licence policies |
| Vulnerability data | Affected packages and versions, with maintainers able to mark a CVE as a false positive and suggest remediation |
| Monitoring | Early signs of risk such as releases that drop support for older versions, licence changes and status changes |
Lifter Programme
The lifter programme is for maintainers who partner with Tidelift and get paid for tasks that matter to commercial users. Lifters verify their package licence and record it in the repository and package metadata, supply a version map with a clear status for each release (stable, long term supported or obsolete), report security vulnerabilities into the Tidelift database so subscribers are notified, and respond to dependency issues Tidelift spots, such as missing licences or deprecated versions. Help desk or consulting work is never part of the deal, and maintainers keep control of their technical roadmap.
How It Works
| Component | What it does |
|---|---|
| Dependency scanning | When a customer subscribes, Tidelift scans its open source dependencies. |
| Maintainer payments | The subscription fee is split among the maintainers of those exact packages. Income is calculated monthly from subscriber usage and applies to a whole project, so co-maintainers share it. |
| Maintainer data | Licence, release and vulnerability information from lifters flows into the package intelligence subscribers see. |
| Customer access | Subscribers use the web UI, APIs or CLI. |
| Maintainer security | Lifters are asked to follow responsible disclosure and to use two-factor authentication where possible, especially on GitHub and package repositories. |
Company Background
| Founded | 2017. |
|---|---|
| Co-founders | Donald Fisher, Havoc Pennington, Luis Villa and Jeremy Katz. |
| Acquisition | Sonar signed a definitive agreement to acquire Tidelift, with the Tidelift offering continuing to be available. The deal extends Sonar’s coverage to open source libraries alongside developer-written and AI-generated code. |
Note: This overview is compiled from Tidelift’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.