Google has, in the past. Look at the ChangeLog for 1.0.0 - the massive improvements made (around PKITS) were sponsored by Google. Google has a healthy Patch Re

Google has, in the past. Look at the ChangeLog for 1.0.0 - the massive improvements made (around PKITS) were sponsored by Google. Google has a healthy Patch Rewards program ( https://www.google.com/about/appsecurity/patch-rewards/ https://www.google.com/about/appsecurity/patch-rewards/ ) that rewards patches to a variety of Open Source Projects. Google also finds a variety of projects through the Core Infrastructure Initiative ( https://www.coreinfrastructure.org/ https://www.coreinfrastructure.org/ ), which OpenSSL is part of https://www.coreinfrastructure.org/announcements/the-linux-foundations-core-infrastructure-initiative-announces-new-backers-first-projects-to-receive-support-and-advisory-board-members/ https://www.coreinfrastructure.org/announcements/the-linux-f...