FROM 26 October 2026, cURL will ask researchers to report low- and medium-severity vulnerabilities through public GitHub issues. High- and critical-severity reports will continue to be handled confidentially through the project’s HackerOne bug bounty programme. Researchers who are unsure how serious a flaw is may still report it privately; maintainers will assess it and, if they judge it low or medium risk, turn it into a public issue.
The change is intended to ease pressure on maintainers, who say they face a growing volume of automated vulnerability reports. The article says AI auditing tools often flag obscure command-option edge cases that may have little relevance to real-world production systems, leaving maintainers to verify claims and assess fixes. cURL lead developer Daniel Stenberg said more than 90% of past submissions were low or medium severity.
Public discussion could let other developers help reproduce issues and suggest improvements, while giving Linux distributions and system administrators earlier visibility of fixes. The trade-off is that publicly disclosed flaws may be examined by attackers before patches are ready.