Starting October 26, curl will handle only high and critical security reports privately. Low and medium ones go straight to the public GitHub repo.
Why
- Maintainer Daniel Stenberg calls it an “avalanche of vulnerability reports,” and he doesn’t expect it to slow down.
- Over the last few years, more than 90% of submissions were quickly judged to be less than high.
- curl already closed its bug bounty this year as AI-generated reports piled up. Researchers who aren’t sure can still file on HackerOne for a severity call.
My take
A tiny team keeps a tool that runs on billions of devices going, and AI slop reports are burning them out. If you use AI to hunt bugs, verify before you submit. And if your company depends on curl, think about how you can help.
Have a blessed day! And Happy Hacking!
