Recent and ongoing EU legislation concerning data protection, product and service security fundamentally change how insecurity is supposed to be dealt with. For FOSS, managing security risks is crucial, and this talk is examining its intersection with these recent legal changes. The talk will focus on practical approaches, strategies and frameworks for assessing, prioritizing, and mitigating security risks. Whether you're a FOSS enthusiast, developer, or security professional, this talk provides valuable insights into safeguarding FOSS use within a shifting regulatory landscape.