The Apache Software Foundation develops and maintains software that the world depends on. But how can it help create software that withstands later attack? How can it counter malicious developers and repository subversion? And how can it encourage and enable innovation while doing so? This talk will broadly discuss how to resist attack while enabling innovation.