When the Heartbleed vulnerability was disclosed, the OpenSSL project had only one core full-time maintainer, Stephen Henson, and the project's annual donation revenue was less than $2,000.