Post

I don't think people really understand how important this is—or how bad it is for curl.

cURL official closes bug-bounty program on hackerone due to AI slop

curl is a commonly used library in almost every major industry, including banks, car manufacturers, phones, and computers. This means that if someone wants to hack a large organization and they are aware of an exploit in a library like curl, I wouldn't be surprised at all if they tried to use it.

26/1/26, 12:41 pm0 reposts0 likes

Emil Privér

@priver.dev

26 Jan

With the recent changes, curl will eventually miss important exploits because: 1. AI "slop" reports are taking up most of the maintainers' time. 2. The removal of monetary rewards takes away one of the main reasons talented exploit researchers look for vulnerabilities in curl in the first place.

Emil Privér

@priver.dev

26 Jan

It doesn’t necessarily mean curl will be less safe overnight, but it definitely means that talented people won’t be looking for exploits in it as much.