Curl is changing how it takes security reports. Starting October 26, low and medium-severity issues should go straight into the project’s public GitHub repository, with private handling reserved for high and critical cases.
Maintainer Daniel Stenberg frames it as triage under duress rather than a philosophy shift. The project has absorbed a rising tide of submissions, and he says more than 90 percent can be assessed as below HIGH severity. Curl already closed its bug bounty programme this year as AI-generated reports piled work onto a small security team.
A survival strategy, not a preference
Stenberg’s account of the project’s state is unusually direct. He says key maintainers feel strained and overloaded to the brink of what they can muster, and that the project sees no end to the flood within the next several months.
Handling reports in public lets more people assess them, write fixes, draft advisories and check for related problems before a release lands. It does not reduce the effort any single report demands. It spreads the work and makes lessons easier to find later. Researchers unsure of severity can still file privately on HackerOne and ask for an assessment.
The trade nobody wants
Public disclosure hands attackers a head start before patches ship, and Stenberg concedes that is unfortunate but unavoidable at this volume. His reasoning for drawing the line below HIGH is that at least those problems are not severe.
He also names a pattern familiar to anyone triaging automated findings: researchers using AI generate bizarre option combinations real applications would never produce, then file the discrepancy as a bug.
The practical consequence for defenders is that curl advisories will start appearing without a coordinated release date. Watch the repository for security-labelled issues and patch on the flaw rather than waiting for an announcement.
