PYTHON SOFTWARE FOUNDATION▊
Organization dossier Governance / institutional Status: operating — grant declined
The Python Software Foundation was recommended for a $1.5 million federal grant — the largest in its history, to harden the security of the world's most-used language — then walked away from it, because taking the money meant attesting that it operates no diversity programs. The board voted unanimously to decline. It ran a small organization on about $5 million a year. It said all of this on its own blog.
the PSF simply can't agree to a statement that we won't operate any programs that "advance or promote" diversity, equity, and inclusion, as it would be a betrayal of our mission and our community.
The Python Software Foundation, in its own blog post announcing the withdrawal, pyfound.blogspot.com (27 Oct 2025)
The PSF Board voted unanimously to withdraw our application. … the PSF needs financial support now more than ever.
The Python Software Foundation, same post, pyfound.blogspot.com
- ENTITY
- Python Software Foundation, a 501(c)(3) nonprofit — steward of the Python language and PyPI; annual budget "around $5 million per year, with a staff of just 14" (PSF's own figure) FACT
- THE GRANT
- A $1.5 million proposal to the US National Science Foundation's Safety, Security, and Privacy of Open-Source Ecosystems (Safe-OSE) program — recommended for funding, a rare first-time success FACT
- THE STRING
- An award term requiring the PSF to attest it does not "operate any programs that advance or promote DEI, or discriminatory equity ideology" — applied to the whole Foundation, not just the funded work, with a clawback right attached FACT
- THE DECISION
- The PSF Board voted unanimously to withdraw the application, and announced it publicly on the Foundation's own blog FACT
- THE DRAMA
- A cash-flagged nonprofit turns down its largest-ever grant on principle. Supporters call it integrity; critics call it politics over the ecosystem's security. Both said so out loud.
- STATUS
- OPERATING — GRANT DECLINED — the PSF continues; it opened a fundraising appeal in the same breath
This one is a nonprofit, not a person, and it is not a fraud. It is here because it is a clean specimen of a governance-priorities drama: an institution asked to choose between money it said it needed and a condition it said it could not sign, choosing the second, and documenting the whole thing itself. No leak, no lawsuit, no denial — the subject is also the primary source.
What follows is the sequence in order, every beat carrying its receipt. The Foundation's own reasoning gets the microphone at full strength. So does the objection. You decide whether principle or the ecosystem's security should have won.
the drama timeline
ACT I — THE APPLICATION (2024–2025)
A small foundation applies for a large grant to do unglamorous work: making the security of an ecosystem billions of lines deep somebody's actual job. It is recommended for funding. For a first-time applicant, that is the hard part — and it goes right.
-
2024–2025
The proposal
The PSF applies to the US National Science Foundation's Safety, Security, and Privacy of Open-Source Ecosystems (Safe-OSE) program — a fund designed to "catalyze meaningful improvements in the safety, security, and privacy" of open-source ecosystems that lack the resources to do it themselves. The proposal, led on the security side by the PSF's Security Developer in Residence, is recommended for funding: $1.5 million, the largest grant the Foundation had ever been offered.
A nonprofit with fourteen staff, offered the biggest check of its life to do the boring, load-bearing work nobody funds. This is the part that was supposed to be difficult.
ACT II — THE STRING (OCT 2025)
Every grant carries terms. This one carried a term that reached past the funded work and into everything the Foundation does — and attached a clawback to it. The Foundation read it closely.
-
OCT 2025
The attestation term
The award terms would have required the PSF to affirm that it does "not, and will not during the term of this financial assistance award, operate any programs that advance or promote DEI, or discriminatory equity ideology in violation of Federal anti-discrimination laws." Per the PSF, the term applied "not only to the security work directly funded by the grant, but to any and all activity of the PSF as a whole," and violating it gave the NSF the right to "claw back" funds already transferred and spent.
The reach is the whole story. A condition on the funded work is a condition. A condition on everything the Foundation does, backed by a right to take spent money back, is a different instrument.
ACT III — THE VOTE (27 OCT 2025)
The Foundation could have taken the money and hoped the broad new language was never tested against it. It chose the other thing, in the open, with its name on it.
-
OCT 27, 2025
The board withdraws — and publishes
The PSF Board votes unanimously to withdraw the application and says why, on the Foundation's own blog: it "can't agree to a statement that we won't operate any programs that 'advance or promote' diversity, equity, and inclusion, as it would be a betrayal of our mission and our community." Deputy executive director Loren Crary tells The Register the new restrictions are broad and untested: "all these restrictions are new, the language is very broad… I had no interest in being the test case."
The rarest move in this archive: the subject writing its own case file, in full, before anyone else could.
ACT IV — THE BILL (OCT–NOV 2025)
Principle is free to declare and expensive to keep. The Foundation named its own price in the same post that declared the principle, and then asked for help paying it.
-
OCT–NOV 2025
The money problem, stated by the subject
In the same announcement, the PSF states the stakes plainly: it is "a relatively small organization, operating with an annual budget of around $5 million per year, with a staff of just 14," and "needs financial support now more than ever." It points readers to its donation and sponsorship channels. Turning down the $1.5 million did not make the security work cheaper; it moved the bill to the Foundation's supporters.
-
EPILOGUE
Operating, grant declined
The PSF continues to run Python and PyPI. The grant is gone; the security work it was meant to fund still needs funding. The blog post stands, uncorrected and unretracted, as both the decision and the receipt for it.
both sides, on the record
The Foundation's case, in its own words: the attestation term was one it "simply can't agree to… as it would be a betrayal of our mission and our community." The restriction was not scoped to the funded security work but to "any and all activity of the PSF as a whole," and carried a right for the NSF to "claw back" money already spent — an open-ended risk to a $5M-a-year nonprofit. Crary's on-record read: "all these restrictions are new, the language is very broad… I had no interest in being the test case" [1] [2].
It chose transparency over the check: the decision was a unanimous board vote, announced by the Foundation itself, on its own blog, with the disputed grant language quoted in full for anyone to read. It did not spin the money away — it stated in the same post that it "needs financial support now more than ever" and asked its community to make up the gap [1].
The critics' objection (theirs, not ours): a cash-strapped nonprofit turned down $1.5 million earmarked for the security of an ecosystem the whole software world depends on — and did it over a policy attestation rather than the work itself. In this reading, the funded outcome (a safer Python supply chain) was the thing that mattered, the DEI language was a signable formality, and declining it prioritized institutional politics over the users who inherit every unpatched vulnerability [2] [5].
The tension is real and the PSF conceded it: the Foundation's own post establishes both halves of the objection — that it needed the money "now more than ever," and that it walked away from the largest grant it had ever been offered. Critics do not have to prove the budget pressure; the subject documented it [1].
YOU DECIDE
Scoped to the choice, not the cause. The facts are not in dispute and were never disputed — the PSF published them itself: a $1.5M NSF grant recommended for funding, an attestation term reaching every PSF program with a clawback attached, a unanimous board vote to withdraw, and a nonprofit that said in the same breath it needed the money. The question the receipts leave open is a values question, not a factual one. Was declining a defense of mission against a broad, untested condition — or a cash-strapped steward putting a policy stance ahead of the ecosystem's security? Both readings are argued on this page in their own advocates' words.
Weigh the costly signal: the PSF paid, in cash it says it needed, to keep a condition off its books. That is what it spent. Whether it bought integrity or an own goal is the reader's call — this file does not make it.
The archive does not judge. The archive merely keeps the tape running.
evidence locker
PRIMARY RECORD
Python Software Foundation — "The PSF has withdrawn a $1.5 million proposal to US government grant program" (27 Oct 2025) SELF-PUBLISHED — the decision, the verbatim attestation term, the unanimous board vote, the mission rationale, and the budget figures, in the subject's own words.
pyfound.blogspot.com/2025/10/NSF-funding-statement.html NSF — Safety, Security, and Privacy of Open-Source Ecosystems (Safe-OSE) program page FACT — the funder and the program the PSF applied to, and its stated purpose.
nsf.gov/funding/opportunities/safe-ose-… Python Software Foundation — donations / sponsorship SELF-PUBLISHED — the appeal the PSF pointed to in the same post; corroborates the stated financial need.
python.org/psf/donations/
PRESS & CONTEXT
TechRadar Pro — "Python rejects $1.5m US government grant to avoid compromising ethics with anti-DEI policies" (Oct 2025) ATTRIBUTED — independent reporting of the decision and the reaction on both sides.
techradar.com/pro/python-rejects-usd1-5m-…
DISCOURSE — INDEX ONLY
X — live search: "Python Software Foundation" NSF grant DEI LIVE SEARCH — the ongoing argument, both sides. The loudest critical commentary (e.g. Lunduke) circulated here; indexed, not relied upon — the substantive record above rests on the PSF's own post and the funder's program page. Search link only; no fabricated permalinks.
x.com/search?q=%22Python%20Software%20Foundation%22%20NSF%20grant%20DEI
The standard. Everything above is sourced to the Python Software Foundation's own blog post, the NSF's own program page, and named trade-press reporting. The grant, its size, the funder, the verbatim attestation term, the unanimous board vote, and the Foundation's stated budget pressure are facts — and are facts because the subject published them itself. The two competing readings — principled defense of mission, or a cash-strapped nonprofit choosing politics over the ecosystem's security — are each presented in their own advocates' words and attributed, never adopted. No fraud is alleged; none exists in this record. No motive is asserted and no private character diagnosed. The burden of proof is on us, not the subject. If it couldn't survive a defamation challenge, it wouldn't be on this page.