Development Bounties
Donate
This page documents how development bounties are used in the Kicksecure (and Whonix) ecosystem. It summarizes past experience with feature-request bounties, potential future platforms, and outlines important considerations such as scope, quality, maintenance, and non-endorsement.
Introduction
[edit]A bounty in this context refers to a monetary reward offered for completing a specific development task or feature request. In simple terms, it is a paid incentive for someone to implement a clearly defined change.
The bounty is intended to incentivize external contributors. External contributors are developers who are not part of the core team. They implement the requested changes and submit a solution. The solution can then be reviewed and, if suitable, merged into the official project source code. This is sometimes called "integrated upstream".
A bounty is not a guarantee that:
- someone will accept the task,
- the final implementation will pass review, or
- the change will be maintained long term if it turns out to be complex or fragile.
Past Experiences with Feature Request Bounties
[edit]In the past, the Whonix project experimented with development bounties. Bountysource
, popular in the past, nowadays seems defunct at the time of writing, March 2026.
There was a $3000 USD bounty on the task Build Debian Packages from Source Code #400. This was a tracked development request on GitHub. GitHub is a platform commonly used to discuss tasks, bugs, and proposed changes.
Due to the large bounty at the time, the bounty was advertised on the Bountysource homepage.
Nobody attempted to submit a solution. Considerable time was spent setting up the bounty and discussing its scope. Scope means what is included, and what is out of scope. Considerable time was also spent discussing requirements. Requirements means what a solution must do to be considered complete. However, this effort did not result in any implementation work or submissions. Nowadays, less time may be assigned to discussion as per Development Discussion Policy.
bounties.monero.social
[edit]Notice: Terms of Service: Non-Endorsement
In other words, links on this page do not mean that Kicksecure or Whonix endorses any specific bounty platform, developer, or outcome. All usual review standards still apply, and the project may accept or reject submissions based on quality, security, and maintainability.
Bounties have been more successful for application specific Kicksecure or Whonix integration tasks. These are often smaller and more clearly bounded tasks, such as adapting an application to work well inside Kicksecure or Whonix.
- kicksecure related bounties on bounties.monero.social
- whonix related bounties on bounties.monero.social
Related tickets that have bounties on bounties.monero.social:
- Non exhaustive list.
- Kicksecure security-misc issue #184
Discussion
[edit]We concluded it would be terrible to mix up the technical discussion on the individual GitHub tickets with how much time a task would need and how much must realistically be charged for it.
It is very hard to estimate how much time the implementation of the necessary changes to Whonix's and Securix's source code would take and, therefore, how much money realistically can be charged for those.
Ideally we could let developers make bids.
Maybe we can use something like bountysource.com. An alternative to bountysource.com would be desirable, because they take a 10% fee for all withdrawals. Do you know any alternatives by chance?Whonix: Where to discuss bounties?
The term "bids" above refers to developers proposing a price and an estimated amount of work for completing a task. While this can help discover realistic pricing, it can also create incentives to underbid. Underbidding can negatively affect quality.
Just a side note that bidding has the risk of picking a person who implements for less money and ending up with code that eventually has a higher maintenance cost. So I would advise against making this a bid race. As an employer, you would not do that, either. You would see if a person fits into the team, has a focus on quality and security and so on.
Related: maintainability
References
[edit]Due to link rot, older web pages can disappear or be moved. Therefore, many original links are no longer available. However, some have been archived for historical context.
- Original bounty source links were not The Web Archive friendly. The archived version is unusable.
- https://www.webcitation.org/6gTIAk6Yj
- https://web.archive.org/web/20160729165404/https://phabricator.whonix.org/T207
- https://forums.whonix.org/t/build-debian-packages-from-source-code/19192
A secure by default operating system with the latest security research in place.
At
Kicksecure we value freedom and trust, supporting Open Source and Freedom Software
2012-
2026 ENCRYPTED SUPPORT LLC
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 14 year success story and maybe DONATE!