OpenLOS

Trust

Don't trust us. Check.

OpenLOS and ORSF are maintained under a pseudonym. Everything that matters can be verified without knowing who that is: the code, how it's built, who decides, and what happens if the maintainer stops.

Every line is public

All code, specs, and the full history of every change are on GitHub. Design decisions and the roadmap are written down.

Signed releases

Release tags and commits are signed with the project key. Docker images carry signed build provenance from the project's own build workflow (Sigstore), so you can confirm what you run was built from the public source.

Written governance

How decisions are made, rules that don't change, and a continuity plan if the maintainer disappears. The licenses guarantee anyone can carry the projects on.

No money from lenders

The project and its maintainers accept no money from lenders or settlement service providers. OpenLOS never ranks loans by what they pay the broker.

No hosted data, no calls home

Each shop runs its own copy; each lender runs its own publisher. The project never holds borrower data or lender pricing, and the software sends no telemetry.

Honest about gaps

A Safeguards Rule self-assessment maps each requirement to what the software does and what a shop must do, including what isn't done yet. An internal security review in October 2026 is published with every finding, fixed or not. No independent review has happened yet.

Verify a release yourself

Signed tag (from OpenLOS v0.5.1 and ORSF v0.3.1):

git clone https://github.com/openlos-project/openlos.git && cd openlos
git config gpg.ssh.allowedSignersFile .github/allowed_signers
git tag -v v0.5.1

Docker image provenance:

gh attestation verify oci://ghcr.io/openlos-project/openlos:latest --owner openlos-project

Documents

Found a vulnerability? Report it privately through GitHub's security tab on the affected repository. Please don't open a public issue.